ci: add shfmt and shellcheck for shell scripts - #691

Add an .editorconfig based on the one podman uses, reformat every shell
script in the tree with shfmt, and add a CI job that keeps it that way.

The .editorconfig is podman's file minus space_redirects, so redirections
keep the shape they already have here. The [[shell]] section is what lets
shfmt pick up hack/github-actions-setup, which is a shell script with a
shebang and no extension; that section is an shfmt extension rather than
something editorconfig itself understands. See
podman-container-tools/podman#28785.

shfmt itself runs the way runc runs it: a make target using a pinned
container image, so that a local run and a CI run cannot disagree about
formatting, plus a localshfmt target for whoever already has shfmt
installed. The CI job is then just "make shfmt".

shfmt finds the files to format on its own, .bats files included, so no
file list has to be maintained anywhere.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found by shellcheck (SC2086). None of these were broken in practice,
since the paths involved never contain whitespace or glob characters, but
quoting them is what keeps that true.

get_conmon_journal_output() is the one place where the word splitting was
load-bearing: its level filter is either empty or "-p <level>", which has
to reach journalctl as two separate arguments. Quoting it as it stood
would have passed it as one, so it becomes an array instead.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found by shellcheck (SC2155). "local x=$(cmd)" makes the exit status of
local, which is always zero, mask the exit status of cmd. None of these
four checked that status, so the bug is latent rather than real, but the
next person to add "set -e" or a status check would not get what they
expect.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found by shellcheck (SC2140, SC2183). Both places build a 65535 character
line the same way, and both were sloppy about it:

The %*s conversion takes a width and a string, so "printf '%*s' 65535"
was relying on printf treating the missing second argument as empty.
Pass the empty string explicitly.

In 02-ctr-logs.bats the whole command was also a double quoted string
containing a bare "65535", which merely concatenated into the intended
text rather than quoting anything. Drop the inner quotes.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found by shellcheck (SC2218). The function sat at the bottom of the file
while seven tests called it. bats sources the whole file before running
any test, so this worked, but shellcheck reads the file as an ordinary
script and cannot know that. Moving the definition next to the other
helpers is also just easier to read.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Five places where shellcheck is reading the code correctly but cannot
know the context, so they get a directive with the reason:

 - two single quoted strings (SC2016) hold script text meant to be
   expanded somewhere else, once in the container and once in a child
   shell that inherits an exported TEST_TMPDIR;
 - two files source /etc/os-release (SC1091), which shellcheck cannot
   follow because it is not part of the tree;
 - in test_helper.bash, status and output (SC2154) come from bats' run,
   and variables such as VALID_PATH (SC2034) are only referenced by the
   .bats files that load the helper.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Run it the same way as shfmt: a make target using a pinned container
image, a localshellcheck target for whoever has shellcheck installed, and
a CI job that is just "make shellcheck". Pinning matters more here than
it does for shfmt, since what shellcheck reports moves between releases
and ubuntu-latest is several versions behind.

The tree is clean as of the preceding commits.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>