ci: run shellcheck at warning severity

The first run reported only info-level notes (SC2015 in update.sh, SC2012 and
SC2086 on the intentional glob in backup.sh), which made the job fail.

.github/workflows/ci.yml

@@ -44,6 +44,21 @@ jobs:
         # as rotating failures in the agent package). Serial package execution
         # keeps the database state deterministic.
         run: go test -p 1 ./...
+      - name: go test -race
+        # Race detector on the packages that pass under -race today. ./server is
+        # left out until it has been checked with -race against postgres.
+        run: >-
+          go test -race -p 1 ./agent ./cmd/artex ./config ./db ./evidence ./guard
+          ./intercept ./llmpool ./llmrec ./mcphttp ./notify ./sidequestion ./traffic
+
+  shell:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # shellcheck is preinstalled on the ubuntu runners. -S warning: the scripts
+      # currently have only info-level notes (intentional A && B || C chains in
+      # update.sh, an unquoted glob in backup.sh's prune), so fail on warnings.
+      - run: shellcheck -S warning install.sh update.sh start.sh scripts/backup.sh
 
   web:
     runs-on: ubuntu-latest

.gitignore

@@ -57,10 +57,7 @@ Thumbs.db
 # bench benchmark related (local artifacts, not committed)
 /bench/
 /Dockerfile.bench
-/Dockerfile.bench.v2
-
-# scripts/backup.sh output (database dumps, data archives)
-backups/
+/Dockerfile.bench.v2backups/
 
 # posture probe raw output
 posture-runs/