feat(code-block-tools): restore shuck as a built-in shell linter

[soy-chrislo]

Description

shuck was previously removed as a built-in because the released CLI had no
stdin support: shuck check - treated - as a literal filename instead of
reading the piped script. That got fixed upstream in shuck v0.0.43
(ewhauser/shuck#1123), so this restores the shuck registry entry as a
shellcheck alternative.

This PR only covers check (lint), not format. That split was discussed
and agreed in #655: format is still flagged experimental upstream and needs
SHUCK_EXPERIMENTAL=1 to run, and rather than adding env-var plumbing to
built-in tool definitions for an experimental feature, the call was to hold
off on it until shuck drops that gate. #655 stays open to track that half.

I verified this against a real shuck v0.0.43 binary before opening this:

• output goes to stdout
• exits 1 on findings, 0 on a clean script
• --output-format concise lines up with the generic file:line:col: message
  parser rumdl already uses for the other built-in tools, so nothing extra
  was needed there

Type of Change

• New feature (non-breaking change adding functionality)

Testing

• Tests added/updated — shuck_lints_shell in
  tests/integration/code_block_tools_execution_test.rs, added to VERIFIED
  (gated by every_builtin_tool_is_verified_or_exempt)
• All tests passing (make test-dev)
• Manual testing performed — ran the new test against a real shuck v0.0.43
  binary in PATH (not skipped by require_tool!)

Checklist

• Code follows project style (cargo fmt, cargo clippy --all-targets -- -D warnings)
• Conventional commit messages used
• Documentation updated (docs/code-block-tools.md regenerated via
  make sync-code-block-tools)

Ref: #655 — left open intentionally; shuck format support is
tracked there as a follow-up once shuck removes the experimental gate.