new test steps:
- branch -d on a nonexistent branch must exit non-zero (was silently exit 0)
- branch name with `/` in it (common feature/* flow, never tested)
- detached HEAD: pull/push/merge must fail cleanly (was confusing fallthrough)
- pull: skips `git stash pop` when nothing was stashed
- pull: pop runs exactly once when something was stashed
- pull: package-manager install hooks (yarn) don't fire when their lockfile didn't change
- push: passthrough flag (--force-with-lease) doesn't get mangled

also a separate shellcheck job (warning-level) so we catch unquoted vars and similar before they ship.

stacked on top of modernize-git-commands — most of these tests rely on those fixes.

- branch: replace `remotes=($(git remote))` with a portable while-read loop (mapfile isn't in macOS /bin/bash 3.2)
- pull: quote `cd "$(dirname ...)"` and add `|| return 1` on both `cd` calls
- push: use `grep -F '*'` for the literal-asterisk match, and unquote the rhs of `=~` so github.com matches as a regex
- install.sh: iterate with `"${FILES[@]}"` instead of `${FILES[*]}`