ci: shellcheck the release scripts on every pipeline

What this does

scripts/*.sh (about 780 lines across the five release scripts) had no static analysis of its own. We add a shellcheck job in the test stage, pinned to koalaman/shellcheck-alpine:v0.11.0, running on merge-request, default-branch, and tag pipelines, the same cadence as version-consistency. It fails on any finding: shellcheck's default minimum severity is style, the strictest level, so no flag is needed to reach it.

What we verified locally

At -S style with -a -x (every optional check, following sourced files), and again through the pinned image itself via podman run, all five scripts come back clean. No script changes were needed, so this MR is the CI job and a CHANGELOG entry only.

What to check on this pipeline

The new shellcheck job should appear in the test stage and pass. glab ci lint is clean against the updated .gitlab-ci.yml.