Check the shell, and stop one-off issues falling off the board

Two gaps, both found the same way -- by something going wrong quietly.

`gh issue create` does not touch the project board. The issue is created, carries its
labels, and is invisible in the Kanban, which looks exactly like a ticket nobody filed.
On 2026-08-24 eight issues filed as a scripted batch all reached the board and one filed
as a one-off minutes later did not; it surfaced only because someone went looking for it.
A batch carries the board step inside its loop. One-offs are where it slips, so
tools/github/file-issue.sh is for one-offs.

Three things it does that a two-command shell snippet would not:

  - Resolves the project, Status field and option ids BY NAME, every run. Caching them
    is the obvious optimisation and the wrong one -- a renamed or reordered column would
    then have this writing a stale id into the board with no error anywhere.

  - Reads the item back. A mutation returning 200 says the request was accepted, not that
    the board shows what was asked for; the read-back is the only step that checks the
    claim this script exists to make. It is a GraphQL query because REST cannot do it --
    the `fields` array REST returns on a project item carries Title and nothing else, so
    a REST-only check reports every item's Status as unset.

  - Exits 3, loudly, with the issue number on a line of its own, when the issue was
    created but the board step failed. That exact combination is the failure being
    prevented; it must never be the quiet path.

Shell was the other language here with nothing checking it -- four scripts, one of them
the CI entry point. shellcheck now runs in the Static analysis job over
`git ls-files '*.sh'`, so a script added later is covered without editing the workflow,
and it runs at full severity with `info` included.

That raises two findings today and both are the tool being wrong, so both are answered
with a targeted `disable` carrying its reason rather than by lowering the severity:
run-e2e.sh's `on_signal` is reported as never invoked when it is installed as the INT and
TERM trap eleven lines below it, and the `$names` inside file-issue.sh's queries are
GraphQL variables that must not expand -- expanding them would send the shell's idea of
$owner to the API instead of declaring a parameter. A blanket --severity=warning would
have hidden both, and the next real finding with them.

The gradle step gains `if: !cancelled()` so a shellcheck failure cannot cost the
ktlint/detekt/lint lists -- the same reason that step already passes --continue.

Not covered, deliberately: shellcheck here reads .sh files, not the inline `run:` blocks
in the workflows, where a good deal of this repo's bash actually lives. actionlint does
read them, and finds one pre-existing info-level issue in build.yml. Wiring it in means
pinning a container digest, because every action here is pinned by SHA and actionlint's
usual installer is a curl-pipe-bash off a moving branch. Its own ticket, not this commit.

CLAUDE.md

@@ -123,6 +123,34 @@ install for code that can never run — and on API 37 the full APK does not fit
 
 - `kotlin.code.style=official`. Gradle stays Kotlin DSL.
 
+- **File one-off issues with `tools/github/file-issue.sh`, not `gh issue create`.** `gh issue
+  create` does not touch the project board, so the issue exists, carries its labels, and is
+  invisible in the Kanban — indistinguishable from never having been filed. Measured 2026-08-24:
+  eight issues filed as a scripted batch all reached the board; one filed as a one-off minutes
+  later did not. A batch carries the board step in its loop; **one-offs are where it slips**, which
+  is what the script is for. It resolves the project and Status ids by name rather than caching
+  them, and it **reads the item back** — a mutation returning 200 is not evidence the board shows
+  what was asked for. Exit 3 means the issue was created but did not reach the board, and prints
+  the number so it cannot be lost quietly.
+
+  `above-cut` and `backlog` are **labels from the 2026-08-22 triage pass** — "worked autonomously
+  overnight" and "held for manual review". They are not board columns. Status carries board state;
+  do not put a cut label on a newly filed ticket.
+
+- **shellcheck runs in CI**, inside the Static analysis job, over `git ls-files '*.sh'` so a new
+  script is covered without editing the workflow. It runs at full severity, `info` included: the
+  two findings that raises today are answered with targeted `disable` directives carrying their
+  reason, exactly as `config/detekt/detekt.yml` carries only the rules this codebase legitimately
+  breaks. Do not silence it with `--severity=warning` — that hides the next real finding too.
+  Locally there is no shellcheck package installed; `podman run --rm -v "$PWD:/mnt:z"
+  docker.io/koalaman/shellcheck:stable <files>` is what was used.
+
+  **It does not cover inline `run:` blocks in the workflows**, and a good deal of this repo's bash
+  lives there. `actionlint` does cover them — it runs shellcheck over each `run:` — and reports one
+  pre-existing `info` finding in `build.yml`. It is not wired in because every action here is
+  pinned by SHA, and actionlint's usual installer is a `curl | bash` off a moving branch; doing it
+  properly means pinning a container digest. Tracked separately rather than bolted on.
+
 ## Dependency versions
 
 Libraries **float on minor + patch** (`coreKtx = "1.+"`). Three groups deliberately do not: