Remove temporary ShellCheck excludes from static-checks workflow

[mrlunchbox777]

Summary

Temporary ShellCheck excludes were added in .github/workflows/static-checks.yaml to unblock CI while we complete the current plan work.

Why

These excludes reduce lint signal and should be treated as short-term debt. We should remove them once the current plan milestones are complete and fix the underlying script warnings.

Scope

• Remove SHELLCHECK_EXCLUDES usage from .github/workflows/static-checks.yaml.
• Fix underlying warnings in shared-scripts/** so ShellCheck passes without those suppressions.
• Keep any truly intentional exceptions narrowly scoped and documented inline.

Plan alignment

This maps to docs/plans/bsctl-codeql-decommission-plan.md (Immediate Next Steps #1: tune static-check targeting/exclusions for stable signal), and should be done after the currently in-flight plan items are finished.

Acceptance criteria

• Static checks run with no broad temporary ShellCheck exclude list.
• CI Shell static checks is green on main.
• Any remaining ignores are minimal, justified, and local.

[mrlunchbox777]

Tracked in PR #337 (workflow pin + temporary shellcheck excludes). This issue remains the follow-up to remove excludes after current plan milestones.