Install ShellCheck & Hadolint in CI and add installer with apt fallback

[silarsis]

Motivation

• Ensure shellcheck and hadolint are available in CI so linting is reproducible and run before builds.
• Provide a developer-friendly installer to fetch the latest releases of the linters and fall back to system packages if necessary.
• Keep script validation comprehensive by including the installer itself in the syntax checks.

Description

• Add test/install-tools.sh, which queries GitHub for the latest shellcheck and hadolint releases, installs the appropriate binaries, and falls back to apt if downloads fail.
• Update .github/workflows/ci.yml to run ./test/install-tools.sh before shellcheck and hadolint, and then keep the docker build steps for image verification.
• Expand test/validate-scripts.sh to include the installer in the list of scripts to syntax-validate, and update AGENTS.md with the new changes.

Testing

• Ran ./test/validate-scripts.sh which completed successfully and validated run.sh, start_squid.sh, test/install-tools.sh, test/detect-proxy.sh, and test/test-proxy.sh.
• Ran ./test/install-tools.sh in this environment and it failed with HTTP 403 errors when fetching GitHub releases and when updating apt, so the linters could not be installed here.
• Attempted shellcheck and hadolint locally (e.g. shellcheck run.sh ... and hadolint Dockerfile ...) and both failed because the commands were not present due to the installer/network failure.
• The CI workflow is configured to run ./test/install-tools.sh, then shellcheck, hadolint, and docker build on ubuntu-latest, so the full lint+build steps will execute in GitHub Actions where network access and Docker are available.

---

Codex Task