Adopt SwiftLint: pre-commit hook + CI + violation cleanup

[odrobnik]

Summary

Adopts SwiftLint on ShellKit, following the field-notes pattern (shareable in-repo hook + CI workflow + initial violation cleanup).

• Pre-commit hook (scripts/hooks/pre-commit, installed via scripts/install-hooks.sh) — auto-fixes staged .swift files, refuses to run when staged files have unstaged edits, then strict-lints what remains. CI-skip via \$CI env var.
• CI workflow (.github/workflows/swiftlint.yml) — macOS + Homebrew SwiftLint so the binary/rule-set matches the hook (no version drift). Path-filtered to .swift / .swiftlint.yml / the workflow file.
• .swiftlint.yml — minimal: Sources + Tests included; .build / .swiftpm excluded. No app target on this library package.
• Initial cleanup — 132 violations → 0, all renames are local-only (no public-API parameter labels touched).

The two commits split cleanly along that boundary:

1. SwiftLint: adopt as pre-commit hook and CI workflow — infrastructure only
2. SwiftLint: clear initial violations to pass --strict — 21-file cleanup

Cleanup breakdown (per iBash field-notes triage)

Rule	Hits	Approach
auto-fixable	24	swiftlint --fix (commas/braces/trailing newlines/implicit-optional-init)
identifier_name	78	Local renames — sb → sandbox, rc → result, h → lower, i/v → index/value, n → count/name, bp/ok → buffer/success, e → entry, etc. No public-API breakage.
optional_data_string_conversion	15	Library streaming sites: surgical // swiftlint:disable:next with "lossy by design" reason. Test sites: switched to String(bytes:encoding:) ?? \"\" (rule's preferred form).
large_tuple	3	New structs: PrivateIP.IPv4Address, HostInfo.UnameInfo.
function_body_length	2	DefaultProcessLauncher.launch split into 4 helpers; HostInfo.real split into realUserAndFull + realSupplementaryGroups.
function_parameter_count	5	Surgical disables on the launcher protocol + 4 conformers — the 7-arg signature mirrors POSIX exec; bundling into a struct breaks every consumer.
cyclomatic_complexity	1	isPrivateIPv4 refactored (top-half handles whole-first-octet ranges, helper handles octet-pair ranges) — no disable needed.
for_where	3	Mechanical for X in Y where Z.
nesting	1	Entry.State disabled with reason — meaningful grouping.

Test plan

• swift build --build-tests clean
• swift test — 33/33 passing
• swiftlint lint --strict exit 0
• After merge: contributors run scripts/install-hooks.sh once to activate the hook locally (or skip it — CI catches anything that lands without the hook).

Reviewer notes

• The hook is not auto-activated; core.hooksPath is set by scripts/install-hooks.sh, which is a one-time-per-clone explicit step.
• No public-API surface changed. The launcher protocol signature is preserved (with swiftlint:disable:this on the protocol method's func launch( line); all 4 conforming implementations keep the same 7-parameter shape.
• Pre-existing diagnostics in ShellTests.swift (4 try warnings on withCurrent calls) are unrelated to this branch — they existed on main before this PR.

🤖 Generated with Claude Code