V3 deterministic shell-script lint capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local shellcheck CLI ingredient exposes bounded project operations for readiness and shell-script lint diagnostics. Lints run from an explicit project directory cwd supplied at execution time, inspect one trusted local shell script path, and return JSON diagnostics via the shell.script_lint catalog operation. Fixed-function and reproducible: no arbitrary shellcheck flags, no shell wrapper, no sourced-file following, no caller-supplied rc/config path, and no network egress. Findings are represented as JSON output instead of failing the op; real invocation errors still fail. Requires shellcheck on PATH (Debian/Ubuntu: apt install shellcheck; macOS: brew install shellcheck). Local and no-egress.