Quality gates: ruff + shellcheck in CI, skillfish-base package

- CI: ruff pyflakes/E9 now BLOCKING on every app (bugbear informational),
  shellcheck on the bash helpers (informational). Current tree: zero findings.
- New package skillfish-base: hardware watchdog config + the boot freeze
  detector/notifier, so these protections reach every install via apt instead
  of living only on the build box. Built+verified in CI like the other five.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MTSistemi

.github/workflows/ci.yml

@@ -38,6 +38,22 @@ jobs:
             esac
           done
 
+      - name: Lint (ruff — pyflakes blocking, bugbear informational)
+        run: |
+          pip install -q ruff
+          PYAPPS="apps/tuner/skillfish-tuner apps/tuner/skillfish-tuner-helper \
+                  apps/hub/skillfish-hub apps/monitor/skillfish-monitor \
+                  apps/kernel-manager/skillfish-kernel-manager apps/ai-panel/skillfish-ai-panel"
+          ruff check --select F,E9 --no-cache $PYAPPS
+          ruff check --select B,PLE --no-cache $PYAPPS || true
+
+      - name: ShellCheck (informational)
+        run: |
+          sudo apt-get -qq install -y shellcheck >/dev/null
+          shellcheck -S warning apps/hub/skillfish-hub-helper apps/kernel-manager/skillfish-kernel-helper \
+            apps/ai-panel/skillfish-gtt system/usr/local/bin/skillfish-freeze-check.sh \
+            system/usr/local/bin/skillfish-freeze-notify.sh scripts/build-debs-ci.sh || true
+
       - name: apps/ vs system/ mirror drift check
         run: |
           set -e

scripts/build-debs-ci.sh

@@ -70,8 +70,20 @@ put $P 0644 system/usr/share/applications/os.skillfish.ai.desktop usr/share/appl
 shot $P apps/ai-panel/os.skillfish.ai.metainfo.xml
 ctrl $P "python3, python3-pyqt6, polkitd | policykit-1" "SkillFish AI - on-device LLM control panel"
 
+P=skillfish-base
+put $P 0755 system/usr/local/bin/skillfish-freeze-check.sh  usr/local/bin/skillfish-freeze-check.sh
+put $P 0755 system/usr/local/bin/skillfish-freeze-notify.sh usr/local/bin/skillfish-freeze-notify.sh
+put $P 0644 system/etc/systemd/system/skillfish-freeze-check.service etc/systemd/system/skillfish-freeze-check.service
+put $P 0644 system/etc/xdg/autostart/skillfish-freeze-notify.desktop  etc/xdg/autostart/skillfish-freeze-notify.desktop
+put $P 0644 system/etc/modules-load.d/skillfish-watchdog.conf         etc/modules-load.d/skillfish-watchdog.conf
+put $P 0644 system/etc/systemd/system.conf.d/10-skillfish-watchdog.conf etc/systemd/system.conf.d/10-skillfish-watchdog.conf
+ctrl $P "systemd, libnotify-bin" "SkillFishOS base - hardware watchdog + freeze detector"
+# base needs its own postinst: enable the watchdog and the freeze check
+printf '#!/bin/sh\nset -e\nif [ -d /run/systemd/system ]; then\n  systemctl daemon-reload || true\n  systemctl enable --now skillfish-freeze-check.service || true\n  modprobe sp5100_tco 2>/dev/null || true\n  systemctl daemon-reexec || true\nfi\nexit 0\n' > "$OUT/$P/DEBIAN/postinst"
+chmod 0755 "$OUT/$P/DEBIAN/postinst"
+
 echo "== building =="
-for P in skillfish-tuner skillfish-hub skillfish-monitor skillfish-kernel-manager skillfish-ai-panel; do
+for P in skillfish-tuner skillfish-hub skillfish-monitor skillfish-kernel-manager skillfish-ai-panel skillfish-base; do
   find "$OUT/$P" -name '__pycache__' -type d -exec rm -rf {} + 2>/dev/null || true
   dpkg-deb --root-owner-group --build "$OUT/$P" "$OUT/out/${P}_${VER}_all.deb" >/dev/null
 done
@@ -85,4 +97,6 @@ check skillfish-tuner_${VER}_all.deb         ./usr/local/bin/skillfish-tuner
 check skillfish-hub_${VER}_all.deb           ./usr/local/bin/skillfish-hub           "return None"
 check skillfish-kernel-manager_${VER}_all.deb ./usr/local/bin/skillfish-kernel-manager skillfish
 check skillfish-ai-panel_${VER}_all.deb      ./usr/local/bin/skillfish-ai-panel       skillfish
+check skillfish-base_${VER}_all.deb          ./usr/local/bin/skillfish-freeze-check.sh unclean-shutdown
+check skillfish-tuner_${VER}_all.deb         ./usr/local/bin/skillfish-tuner          _silicon
 echo "ALL DEBS VERIFIED"