ci: lint the shell scripts with shellcheck

.github/workflows/lint.yaml

@@ -62,3 +62,21 @@ jobs:
         with:
           reporter: github-check
           fail_level: error
+
+  shellcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      checks: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: reviewdog/action-shellcheck@0a90156c6e0553996a217f0a9e09be6b0f6bee4c  # v1.34.0
+        with:
+          reporter: github-check
+          filter_mode: nofilter
+          fail_level: any
+          check_all_files_with_shebangs: true

.shellcheckrc

@@ -0,0 +1,3 @@
+# do-backup calls its functions through trap, which shellcheck does not follow.
+# Older shellcheck reports that as SC2317 and newer as SC2329.
+disable=SC2317,SC2329