Restore ShellCheck CI and harden install, credentials, and first-run docs

[andersyin]

Summary

This toolkit was just listed in awesome-restic (PR #49), but main was not in a trustworthy state for new visitors:

• GitHub Actions history shows ShellCheck failed at 20a922d, then a follow-up commit went green — after a history rewrite those CI/community files were gone while README still linked them (broken badge, missing CONTRIBUTING.md / issue templates).
• install.sh loaded launchd plists from the parent of the repo, so a fresh clone could not register agents.

This PR restores CI, fixes that install bug, and lands a small set of robustness/docs changes rather than new backup features.

What changed

CI / public listing

• Add .github/workflows/shellcheck.yml: bash -n plus ShellCheck at warning severity on push/PR.
• Restore CONTRIBUTING.md and issue/PR templates that README already linked.
• README: listed in awesome-restic, accurate file tree, first-run steps, Intel restic autodetection, Keychain/RESTIC_PASSWORD_COMMAND notes.

Install / uninstall (launchd)

• Load plists from the script directory (__SCRIPT_DIR__ substitution), not ../.
• Refuse to install while config.sh still has YourWorkDrive / YourArchiveDrive / YourBackupDrive placeholders.
• Do not create an empty crontab if the user never had one; print uninstall/next-step commands.
• uninstall.sh now uses set -euo pipefail, the same agent list, and documents that backup data and the Keychain item are kept.

Script robustness

• Restic password via RESTIC_PASSWORD_COMMAND (Keychain). Scripts no longer export RESTIC_PASSWORD.
• Auto-detect restic at /opt/homebrew/bin then /usr/local/bin.
• daily-work-mirror.sh honors WARN_PCT / ABORT_PCT and no longer strips the leading zero from hour 00 (midnight night window).
• Cold backup skips missing tier paths; a failed tier is error, not ok.
• Consistent set -uo pipefail (or set -euo pipefail where failures should abort).

Testing

Linux CI cannot run macOS launchd/Keychain/restic jobs; this PR does not invent those tests.

Locally on this branch:

for f in *.sh; do bash -n "$f"; done
shellcheck --severity=warning --format=gcc *.sh   # clean (also clean at default severity)

Please confirm GitHub Actions ShellCheck is green on this PR before merging. After merge, a smoke test on a Mac is: edit config.sh off the placeholders, add the Keychain item, bash install.sh, then bash uninstall.sh.