ci(packaging): shellcheck the packaging scripts and document entry points

[chrisnojima]

What

Guards the packaging scripts against regressions. Stacked on #29757.

• New Jenkins stage: Shellcheck, at the start of test_linux in the Jenkinsfile, runs shellcheck -S warning -x from the repo root over packaging/**/*.sh, shared/react-native/gobuild.sh and packageAndBuild.sh.
  • It runs only when one of those files or the Jenkinsfile changes, using the same change detection as the existing Jenkinsfile-change check.
  • Jenkins installs shellcheck itself: the setup step, next to the golangci-lint install, downloads shellcheck v0.11.0 for the node's architecture into $GOBIN and checks its SHA-256. A failed download or checksum mismatch stops the setup before anything is extracted.
  • A failure fails continuous-integration/jenkins/branch, which is also the check the release wait-ci gate in lib.sh waits on.
• Warning-level fixes so the job starts green:
  • ${BASH_SOURCE[0]} where scripts used bare $BASH_SOURCE;
  • # shellcheck source= directives;
  • removed unused variables;
  • a quoted $(...) and a quoted trap string;
  • quoted bundle URLs in packageAndBuild.sh. Unquoted, the & in them sent curl to the background and turned the rest of the URL into stray variable assignments. Those pre-warm requests are kept non-fatal. They only run when packageAndBuild.sh gets platform arguments, and rn:start:legacy doesn't pass any. The constant-word case checks there are now plain if tests that behave the same;
  • the single-architecture loops in linux/deb/layout_repo.sh and linux/rpm/layout_repo.sh stay loops, so another architecture can be added, with SC2043 disabled on them.
• packaging/README.md:
  • a table of each entry script, what launches it (keybot, winbot or the Linux build host) and the environment it reads;
  • KBFS_COMMIT is also listed: keybot still sends it, but nothing reads it;
  • sections on lib.sh and the Jenkins shellcheck stage.

Testing

• This PR changes the Jenkinsfile, so the Shellcheck stage runs on it.
• The install snippet, run locally as Groovy renders it: the real checksum installs shellcheck; a corrupted checksum fails and extracts nothing.
• The edited scripts passed the same shellcheck command in an earlier GitHub Actions run of this PR.
• Every edited script passes bash -n.