fix(hooks): pass -x to shellcheck and fix source= directive path

Two related fixes exposed when install.sh was first staged post-audit:

1. shellcheck invocation in setup-hooks.sh lacked -x, causing SC1091
   (info) to fire for any .sh file that sources another, blocking the
   pre-commit hook on legitimate scripts.

2. The shellcheck source= directive in install.sh pointed to
   'deploy-manifest.sh' (bare filename). With -x, shellcheck resolves
   this from CWD (repo root), where the file doesn't exist. Updated to
   'scripts/deploy-manifest.sh' — the correct repo-root-relative path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q

scripts/install.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=deploy-manifest.sh
+# shellcheck source=scripts/deploy-manifest.sh
 source "$REPO_ROOT/scripts/deploy-manifest.sh"
 
 # Collect provider skill adapters from all provider-manifest.sh files
@@ -39,7 +39,7 @@ skills_dest="$HOME/$DEPLOY_SKILLS_SRC"
 mkdir -p "$skills_dest"
 for skill_dir in "$REPO_ROOT/$DEPLOY_SKILLS_SRC"/*/; do
   skill_name="$(basename "$skill_dir")"
-  rm -rf "$skills_dest/$skill_name"
+  rm -rf "${skills_dest:?}/${skill_name:?}"
   cp -r "$skill_dir" "$skills_dest/$skill_name"
 done
 

scripts/setup-hooks.sh

@@ -147,7 +147,7 @@ staged=$(git diff --cached --name-only --diff-filter=ACM)
 # shellcheck on staged .sh files
 if command -v shellcheck &>/dev/null; then
   while IFS= read -r f; do
-    [[ -f "$f" ]] && shellcheck "$f"
+    [[ -f "$f" ]] && shellcheck -x "$f"
   done < <(echo "$staged" | grep '\.sh$' || true)
 else
   echo "Warning: shellcheck not installed — shell script linting skipped" >&2