ci: silence SC2187 on the busybox-sh shebangs (shellcheck 0.9 vs 0.10)

ubuntu-latest ships shellcheck 0.9.0, which warns that ash scripts are
checked as dash; 0.10 (local) does not. shell=dash is the accurate dialect
for busybox ash. Verified clean under BOTH versions; boot smoke re-run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/etc/rc

@@ -1,4 +1,5 @@
 #!/bin/busybox sh
+# shellcheck shell=dash
 # Stage-1 rc: sourced by /init (still PID 1, initramfs root) when a virtio
 # disk is present. Emulates U-Boot's slot choice — mount the validated slot's
 # rootfs and switch_root into it. This is an EMULATION of the A/B selection

qemu/rootfs/init

@@ -1,4 +1,5 @@
 #!/bin/busybox sh
+# shellcheck shell=dash
 # WardenOS QEMU device sim: initramfs /init (PID 1).
 #
 # Phase-1 duty: prove the kernel booted on -M virt — print the sentinel the

qemu/rootfs/sbin/init

@@ -1,4 +1,5 @@
 #!/bin/busybox sh
+# shellcheck shell=dash
 # Stage-2 init: PID 1 on the disk rootfs (rootfs_a or rootfs_b), reached via
 # switch_root from the initramfs. Brings up the minimum a WardenOS userspace
 # needs — mounts, by-name symlinks, network, serial alias — then starts any