Rewrite the Shell Scripts rules in house style

AGENTS.md

@@ -302,38 +302,23 @@ the user docs.
 
 ## Shell Scripts
 
-**Always run `shellcheck` after editing any shell scripts.**
+**Every shell script in this repo must pass `shellcheck` before its change
+lands.**
 
-```bash
-shellcheck path/to/script.sh
-```
-
-Or validate all shell scripts in the project:
+Right now that is exactly one script: `vendor_chattolib.sh`. After editing
+it — or adding any other script — run:
 
 ```bash
-find . -name "*.sh" -exec shellcheck {} \;
+shellcheck vendor_chattolib.sh
 ```
 
-### Configuration
-
-Project-specific shellcheck rules are defined in `.shellcheckrc`. Default severity is `error` to catch all issues.
-
-### Why
+Fix what it reports instead of suppressing it, same stance as *Linting &
+Type Checking* above: an exemption is a deliberate decision recorded here in
+this document, never an inline disable. If a future script ever needs
+project-specific options, put them in a `.shellcheckrc`, commit that file,
+and name it here.
 
-- Prevents syntax errors and common pitfalls (e.g., missing quotes, unsafe variable expansions)
-- Ensures portability across different shell environments
-- Maintains code quality and security standards
-
-### Integration
-
-Consider adding a pre-commit hook for automatic validation:
-
-```yaml
-# .pre-commit-config.yaml
-repos:
-  - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: v0.9.0
-    hooks:
-      - id: shellcheck
-        args: [--severity=error]
-```
+Why this earns a rule of its own: the script deletes things (`rm -rf
+"$VENDOR_DIR"`, the build-dir trap), so a quoting or word-splitting bug is
+destructive rather than merely wrong output — and both are exactly the
+mistakes review tends to skim past.