chore(deps): remove vulnerable ShellCheck wrapper

[corwinm]

Summary

• remove the unmaintained shellcheck npm downloader wrapper and its vulnerable decompress dependency chain
• install official ShellCheck v0.11.0 directly in CI from the upstream GitHub release
• verify the downloaded Linux x86-64 archive against a pinned SHA-256 checksum before extraction
• document Homebrew installation for local macOS development
• retain the existing npm run shell:check and lint-staged commands, which now use ShellCheck from PATH

Security context

• Resolves critical Dependabot alert #1
• Advisory: GHSA-mp2f-45pm-3cg9 / CVE-2026-53486
• Vulnerable package: decompress <= 4.2.1
• The removed shellcheck@4.1.0 wrapper pinned decompress@4.2.1, which has no published patched version

Verification

• brew install shellcheck (installed ShellCheck 0.11.0 for local development)
• npm ci
• npm audit --json (0 vulnerabilities)
• npm ls shellcheck decompress --all (neither package installed)
• independently downloaded the official Linux x86-64 archive and verified SHA-256 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
• verified the archive layout matches the directory added to $GITHUB_PATH
• npm run fmt:check
• npm run lint
• npm run shell:fmt:check
• npm run shell:check
• npm run typecheck
• npm test (127 passing)
• npm run check