chore: add CodeQL analysis and ShellCheck linting workflow

[zouguangxian]

No description provided.

[cursor]

PR Summary

Medium Risk
CI is updated to run CodeQL with broader triggers and to lint shell scripts, which may newly fail or gate merges due to findings or stricter checks.

Overview
Adds a CodeQL GitHub Actions workflow that runs CodeQL (with security-extended queries) on pushes/PRs/merge-queue to main and dev, with concurrency control, pinned action SHAs, and an all-checks job that fails the workflow if any required job fails.

Introduces a shellcheck job to lint repository shell scripts, and makes small bash-script hygiene tweaks (switch .devcontainer/post-create to bash + newline/formatting, and adjust bootstrap’s ROOT assignment/readonly to satisfy stricter shell tooling).

^{Written by Cursor Bugbot for commit b29b598. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​ludeeus/​action-shellcheck@​00cae500b08a931fb5698e11e79bfbd38e612a38

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}