ci: trim shellcheck step comment, fail loudly on empty discovery

Move the SC2016 / -S warning rationale to the PR body — a decision
justification, not something that needs to live inline forever. Keep
only the one line that explains the non-obvious part of the code
itself: shebang-based discovery over a *.sh glob.

Also make the no-files case explicit: an empty match previously fell
through to shellcheck with no arguments (a confusing usage error, but
still non-zero); now it prints a clear message and exits 1.

.forgejo/workflows/ci.yml

@@ -56,6 +56,22 @@ jobs:
       - name: lint
         run: sh scripts/check-attribution-trailers.sh
 
+  shellcheck:
+    name: shellcheck
+    runs-on: [hive-ci]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # By shebang, not a `*.sh` glob — scripts/pre-push has no suffix.
+        run: |
+          files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
+          if [ -z "$files" ]; then
+            echo "no shell files discovered under scripts/ — check the shebang pattern" >&2
+            exit 1
+          fi
+          echo "$files" | xargs nix develop -c shellcheck -S warning
+
   prose-lint:
     name: prose lint (vale)
     runs-on: [hive-ci]