Add shellcheck (closes #2)

Install shellcheck from apt, which ships a current 0.11 release, and
check it in the smoke test.

Model: deepseek-v4-pro

build.sh

@@ -25,7 +25,8 @@ apt-get -y install --no-install-recommends \
     python3 python3-dev python3-pip python3-venv virtualenv \
     libbz2-dev libffi-dev libgdbm-dev liblzma-dev libncurses-dev \
     libreadline-dev libsqlite3-dev libssl-dev libxml2-dev libxmlsec1-dev \
-    tk-dev uuid-dev zlib1g-dev
+    tk-dev uuid-dev zlib1g-dev \
+    shellcheck
 
 # --- Go (latest) -------------------------------------------------------------
 gover="$(curl -fsSL 'https://go.dev/VERSION?m=text' | head -n1)"
@@ -96,6 +97,7 @@ rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 # --- sanity ------------------------------------------------------------------
 go version
 golangci-lint version
+shellcheck --version
 hugo version
 node --version
 npm --version