fix(build): implement sprint 1 shell reliability baseline

[frolui]

Motivation

• Address /bin/sh: 1: Bad substitution noise observed during make precommit by removing the shell-portability trigger and adding an explicit guard.
• Make local/test precommit checks deterministic across environments by validating required shell tooling and avoiding auto-install side effects.
• Preserve CI/release Sentry behavior while disabling it by default for local runs to avoid accidental network/installation steps during developer checks.

Description

• Added scripts/check_shell_compat.sh which validates bash availability, verifies executability, and runs bash -n syntax checks for the guarded scripts.
• Wired a new check-shell-compat Make target into precommit and added it to .PHONY in Makefile so make precommit runs the shell guard.
• Made the Sentry Maven plugin opt-in for local/test runs by adding the sentry.plugin.skip property in pom.xml, switching the plugin <skip> to ${sentry.plugin.skip}, and disabling auto-install (<skipAutoInstall>true</skipAutoInstall>).
• Kept CI/release behavior explicit by updating GitHub workflow Maven commands to pass -Dsentry.plugin.skip=false so CI still performs Sentry uploads when intended.
• Updated documentation to reflect the changes (docs/testing.md, docs/sprint-plan.md, docs/todo.md).

Testing

• Ran make precommit and it completed successfully with the shell compatibility checks passing.
• Ran TEST_MODE=1 PYTHONPATH=. make -B -j all and it completed successfully.
• Maven unit tests executed as part of the run with Tests run: 201, Failures: 0, Errors: 0, Skipped: 0 and BUILD SUCCESS.

---

Codex Task