Restore warning-level ShellCheck and harden install, paths, and first-run docs

[andersyin]

Summary

ShellCheck on main looked green after 999fabf, but that commit only dropped severity from warning to error. The earlier failures at 3768fa9 and 0a26e3d were real warnings (quoted =~, unused vars, unicode quotes, ls | grep). Community files were already present; this repo did not have the restic-toolkit history-rewrite problem.

This PR restores warning-level CI, fixes those lint issues, and lands the same class of first-run safety as restic-backup-toolkit: refuse placeholder paths, do not register launchd until config is edited, and do not mkdir a fake disk under /Volumes.

What changed

CI

• Replace ludeeus/action-shellcheck@master with apt-get install shellcheck.
• Run bash -n *.sh plus shellcheck --severity=warning.

Install / uninstall

• install.sh refuses YourExternalDrive placeholders before Homebrew or launchd.
• Detect Homebrew at /opt/homebrew and /usr/local (Intel Macs).
• Verify idevice_id / exiftool after brew install.
• uninstall.sh uses one agent list, prints real paths from config.sh, and documents hash / device_seen / .state cleanup without deleting backup files.

Script robustness

• Resolve afcclient / idevicepair / idevice_id / exiftool from Apple Silicon Homebrew, Intel Homebrew, or PATH.
• Backup scripts honor PHOTO_EXTENSIONS / VIDEO_EXTENSIONS.
• If a /Volumes/... target disk is unmounted, notify and exit instead of creating a fake volume directory.
• rebuild_hash_index.sh and legacy backup_safe.sh use config.sh and the same placeholder/volume checks.

Docs

• Quick Start is now: edit config.sh, then install.sh.
• First-run: mount disk, Trust This Computer, check /tmp/iphone_backup_monitor.status.
• CONTRIBUTING: bash -n and ShellCheck; Linux CI cannot exercise USB/launchd.

Testing

Linux CI cannot run macOS launchd / USB / libimobiledevice; this PR does not invent those tests.

Locally on this branch:

bash -n *.sh
shellcheck --severity=warning --format=gcc *.sh   # clean
bash install.sh                                   # exits 1 on YourExternalDrive

Please confirm GitHub Actions ShellCheck is green on this PR before merging. After merge, a Mac smoke test is: edit config.sh off the placeholders, bash install.sh, plug in a trusted iPhone with the disk mounted, then bash uninstall.sh.

Do not merge until you have reviewed — this is the next repo after restic-backup-toolkit.