Add Rust formatting, Clippy, and ShellCheck gates to CI

[richardcase]

Problem

CI runs Rust tests but does not enforce formatting or lint cleanliness. On the audited snapshot, cargo fmt --check reports widespread drift and strict Clippy reports five diagnostics; ShellCheck also reports a warning in check-copy-claims.sh.

Evidence: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/ci.yml#L215-L220

Acceptance criteria

• Add a pinned-toolchain cargo fmt --check job.
• Add a deliberate Clippy policy and fix or explicitly allow current diagnostics.
• Run ShellCheck for repository scripts.
• Keep failures actionable and avoid making release checks dependent on unpinned toolchain changes.