Add shellcheck (closes #2)

Install shellcheck from apt, which ships a current 0.11 release, and
check it in the smoke test.

Model: deepseek-v4-pro

bin/test

@@ -21,6 +21,7 @@ docker run --rm "$img" bash -ec '
     COREPACK_ENABLE_NETWORK=0 yarn --version
     COREPACK_ENABLE_NETWORK=0 pnpm --version
     prettier --version
+    shellcheck --version
 '
 
 echo "== $img: runit service lifecycle"