Add pre-push gate, container smoke test, README docs; drop vendored gum.md

- hooks/pre-push: bash -n + shellcheck -S warning -e SC1090 on every
  tracked *.sh; fails closed when shellcheck is missing, bypassable with
  --no-verify; enable with 'git config core.hooksPath hooks' (documented)
- tests/smoke.sh: manual docker/podman Arch-container run of bat.sh,
  zsh.sh and fish.sh with assertions (idempotent bat config, timestamped
  zsh backups, fisher actually installed in fish); LazyVim.sh opt-in.
  This catches the inverted-condition/quoting class shellcheck cannot.
  fish.sh gains a SKIP_END4_SETUP=1 test hook to skip end-4's installer
- README: scripts table (documents installbeta.sh vs install.sh and why
  SecureBoot.sh is not in the menu), apt full-upgrade note, development
  section; claims audited against current behavior (gum wording already
  correct, no whiptail/selection claims remain)
- remove untracked vendored gum.md (reference only, per decision)

hooks/pre-push

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Pre-push gate: syntax-check and shellcheck every tracked shell script.
+# Enable once per clone with:  git config core.hooksPath hooks
+# Bypass a single push with:   git push --no-verify
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+mapfile -t scripts < <(git ls-files '*.sh')
+if [ "${#scripts[@]}" -eq 0 ]; then
+  echo "pre-push: no tracked shell scripts found" >&2
+  exit 0
+fi
+
+status=0
+
+for f in "${scripts[@]}"; do
+  if ! bash -n "$f"; then
+    echo "pre-push: bash -n FAILED for $f" >&2
+    status=1
+  fi
+done
+
+if ! command -v shellcheck >/dev/null; then
+  echo "pre-push: shellcheck is not installed - the gate cannot run." >&2
+  echo "  install it (e.g. 'pacman -S shellcheck' or 'apt install shellcheck')" >&2
+  echo "  or bypass this once with: git push --no-verify" >&2
+  exit 1
+fi
+
+# SC1090 (can't follow non-constant source) is excluded: every 'source ~/.bashrc'
+# style call in these scripts triggers it and it is not actionable.
+if ! shellcheck -S warning -e SC1090 "${scripts[@]}"; then
+  echo "pre-push: shellcheck reported problems (see above)" >&2
+  status=1
+fi
+
+if [ "$status" -eq 0 ]; then
+  echo "pre-push: all ${#scripts[@]} shell scripts pass bash -n + shellcheck"
+fi
+exit "$status"