fix(ci): make ShellCheck coverage fail closed

[ITSMERNB]

Summary

• make the ShellCheck file enumeration fail closed on missing roots and an empty scan
• derive maintained shell files by shebang so extensionless hooks are covered
• include .githooks/pre-commit and .githooks/pre-push
• keep GitHub CI and ci-local on the same enumerator
• add a release coverage gate over every tracked shell file with a count floor

Validation

• bash -n scripts/shellcheck-files.sh tests/release/shellcheck-coverage.test.sh scripts/ci-local.sh
• bash tests/release/shellcheck-coverage.test.sh -> 195 tracked shell files covered
• missing-root fixture -> refused and names the missing root
• empty-root fixture -> refused instead of passing over zero files
• .githooks/pre-commit and .githooks/pre-push present in the derived scan
• git diff --check

Closes #409