chore(deps): remove vulnerable ShellCheck wrapper

.github/workflows/ci.yml

@@ -23,6 +23,19 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Install ShellCheck
+        env:
+          SHELLCHECK_VERSION: 0.11.0
+          SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
+        run: |
+          archive="$RUNNER_TEMP/shellcheck.tar.xz"
+          curl --fail --silent --show-error --location \
+            --output "$archive" \
+            "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --xz --file "$archive" --directory "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/shellcheck-v${SHELLCHECK_VERSION}" >> "$GITHUB_PATH"
+
       - name: Check formatting
         run: npm run fmt:check
 

README.md

@@ -431,6 +431,12 @@ This means any `kiro-cli` pane can be discovered and switched to without naming
 
 If you edit this repo outside `~/.tmux/plugins/coding-agents-tmux`, tmux will still be using the TPM-installed copy until you sync it.
 
+Local development requires ShellCheck. On macOS, install it with Homebrew:
+
+```bash
+brew install shellcheck
+```
+
 Useful commands:
 
 ```bash