scripts: Fix shellcheck errors

Fix shellcheck SC2068 (unquoted array expansions), SC2145 (mixed string/array arguments), SC2328 (redirection in command substitution), SC2173 (untrapable signals), and SC2148 (missing shebang) errors across 14 script files.
Also configure scripts/Makefile with --severity=error so that only errors (not warnings or notes) cause check failures. To be tightened by follow-up commits.
Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF:IQ4_NL and pi.dev
Signed-off-by: Jan Lindemann <jan@janware.com>

scripts/dpm.sh

@@ -2,14 +2,14 @@
 
 log_dpkg()
 {
-	echo dpkg $@
-	/usr/bin/dpkg $@
+	printf '%s\n' "dpkg $*"
+	/usr/bin/dpkg "$@"
 }
 
 run()
 {
-	echo $@
-	eval $@
+	printf '%s\n' "$*"
+	eval "$@"
 }
 
 # to be used on debian prior to jessie
@@ -112,9 +112,9 @@ cmd_query()
 
 	local p=`echo $1 | sed 's/-[0-9.-]\+$//'`
 	local v=`echo $1 | sed "s/^$p-*//"`
-	local ip=`dpkg-query -W -f '${Package}' $p >/dev/null 2>&1`
+	local ip=$(dpkg-query -W -f '${Package}' "$p" 2>/dev/null)
 	[ $? != 0 -o -z "$ip" ] && exit 1
-	local iv=`dpkg-query -W -f '${Version}' $p >/dev/null 2>&1`
+	local iv=$(dpkg-query -W -f '${Version}' "$p" 2>/dev/null)
 	[ "$v" ] && {
 		[ "$v" != "$iv" ] && {
 			echo "tried $1, installed version is $iv" >&2
@@ -134,7 +134,7 @@ usage()
 
 fatal()
 {
-	echo $@ >&2
+	printf '%s\n' "$*" >&2
 	exit 1
 }