ci: run shellcheck on the deployment scripts

[L4XB]

Goal

deploy/community/test.sh validates every deployment script with bash -n,
which catches syntax errors and nothing else. These scripts handle secrets,
paths, and docker compose invocations on someone else's server; unquoted
expansions and silently ignored failures are exactly the class of bug
shellcheck finds and bash -n does not.

No shellcheck invocation exists anywhere in the repository today.

Where

• deploy/community/test.sh — the bash -n loop
• .github/workflows/ci.yml — the job that runs bash deploy/community/test.sh
• deploy/community/*.sh — init-env.sh, preflight.sh, quickstart.sh,
  backup.sh, restore.sh

What to do

1. Run shellcheck deploy/community/*.sh locally and read the output first.
2. Fix what it finds, or justify a narrowly scoped # shellcheck disable=
   with a comment saying why — a blanket disable at the top of a file is not an
   acceptable answer.
3. Wire it into test.sh so it runs for everyone, and make sure CI has
   shellcheck available.

If the fix list turns out to be large, split it. One pull request that adds
the check and fixes the findings in preflight.sh is more reviewable than one
that touches five scripts. Say in the pull request which files you covered and
open a follow-up for the rest — that is a good outcome, not an incomplete one.

Careful

preflight.sh is a fail-closed security gate. A change that makes a check pass
where it previously failed is a regression even if shellcheck is happier. Read
what each check asserts before touching it.

How to verify

shellcheck deploy/community/*.sh
bash deploy/community/test.sh

Acceptance criteria

• shellcheck runs from test.sh and in CI
• The scripts it covers pass
• Every disable is per-line or per-file-scoped with a stated reason
• No fail-closed check became more permissive