ci: add GitHub Actions CI with ShellCheck, bats unit tests, and a host-prep matrix

[mrrobot47]

What this adds

The installer had no automated testing. This adds a first test layer plus CI, with no changes to the installer's production code (setup.sh / functions are untouched — purely additive).

CI — .github/workflows/ci.yml + .shellcheckrc

• ShellCheck — gates setup.sh + functions at error severity (both are error-clean today); reports the migration scripts informationally until their findings are triaged.
• shfmt — informational formatting diff.
• Unit tests — bats suite.
• Integration matrix — host-prep run across Ubuntu 22.04 / 24.04 / 26.04 / rolling / devel and Debian 12 / 13.

Unit tests — tests/unit/*.bats (31 tests)

External commands (apt-get, curl, sleep, …) are stubbed on PATH, so nothing touches the host:

• parse_args flag handling
• ee_apt_update — retries only on apt/dpkg lock contention, aborts on any other error
• get_ondrej_php_ppa_release_status — 200 / 404 / curl failure
• ee_select_and_install_php — native vs third-party PPA, version-first ordering, no-candidate
• download_and_install_easyengine — checksum match / mismatch / empty phar / empty checksum / download failure

Integration — tests/integration/host-prep.sh (+ run-matrix.sh)

Runs the host-prep stage against a distro's real apt repos in a container, bounded before the phar download / image pull (docker stubbed). That step (ee cli info → global service image pulls) is EasyEngine-core behaviour, needs a Docker daemon, and is slow/flaky in CI — so it's out of scope here. What remains is the OS-version-dependent surface that has actually regressed before (PHP selection across releases + the required PHP extensions), which can only be validated against real distro repos and the real ondrej/sury PPAs.

Verification

• 31/31 unit tests pass (bats/bats container).
• ShellCheck error-gate green on the core; .shellcheckrc suppresses the unfollowable-source warnings for the runtime-sourced helpers.
• host-prep passes on Ubuntu 24.04, 26.04, devel (26.10), and Debian 12 — PHP installed via the native repo or the ondrej/sury PPA as appropriate.

Known issues surfaced (documented in tests/README.md, not fixed here)

• --dry-run is documented and parsed (EE_DRY_RUN) but read nowhere → ee migrate --dry-run performs a real migration.
• --trace sets EE_TRACE, but the migration scripts check $TRACE → no-op. --all (EE_SITE_ALL) is also unused.
• migration/migrate.sh:156 references $new_site_name, which is never assigned.
• migration/{migrate,remote-migrate} reference undefined $migrate / $Red / $RCol, plus 8 error-level SC2068 unquoted array expansions.

Possible follow-ups

• An EE_LOCAL_PHAR seam (mirroring the existing EE_LOCAL_FUNCTIONS hook) to enable a full setup.sh end-to-end + idempotency test, and to support air-gapped/mirror installs.
• add_ssl_renew_cron coverage (incl. the no-existing-crontab case).
• Fix the migration-script issues above and ratchet ShellCheck to gating for them.
• Optionally add debian:testing (Forky/14) as the Debian analog of ubuntu:devel for next-release early warning.