ci: add shellcheck linter for ci scripts (#7331)

## Summary

Adds [shellcheck](https://www.shellcheck.net/) to the PR linting CI
steps -- when a PR has changed a `*.sh` file.

┆Issue is synchronized with this [Notion
page](https://www.notion.so/PR-7331-ci-add-shellcheck-linter-for-ci-scripts-2c66d73d365081be889bf256cde92281)
by [Unito](https://www.unito.io)

scripts/cicd/check-shell.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(git rev-parse --show-toplevel)"
+cd "$ROOT_DIR"
+
+if ! command -v shellcheck >/dev/null 2>&1; then
+  echo "Error: shellcheck is required but not installed" >&2
+  exit 127
+fi
+
+mapfile -t shell_files < <(git ls-files -- '*.sh')
+
+if [[ ${#shell_files[@]} -eq 0 ]]; then
+  echo 'No shell scripts found.'
+  exit 0
+fi
+
+shellcheck --format=gcc "${shell_files[@]}"