chore: add linting infrastructure for shell, Docker, and GH Actions

Add pre-commit hooks for comprehensive static analysis:
- shellcheck and shfmt for shell script linting/formatting
- hadolint for Dockerfile linting
- actionlint for GitHub Actions workflow validation
- zizmor for GitHub Actions security analysis
- ty (Astral) for Python type checking

Add configuration files:
- .hadolint.yaml - Dockerfile linting rules
- .shellcheckrc - Shell script linting rules

Update .gitignore for new tool artifacts.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -59,3 +59,10 @@ common/common/datastructures/fuzzer_msg*
 crs_scratch/*
 tasks_storage/*
 node_data_storage/*
+
+# Serena runtime files (keep .serena/project.yml tracked)
+.serena/memories/
+.serena/*.log
+
+# WASM runtimes (downloaded for seed-gen sandbox tests)
+.wasm/

.hadolint.yaml

@@ -0,0 +1,12 @@
+# Hadolint configuration for Buttercup
+# https://github.com/hadolint/hadolint
+
+ignored:
+  # Pin versions in apt-get install - impractical for multi-arch builds where
+  # versions vary by base image and architecture; base image provides reproducibility
+  - DL3008
+
+trustedRegistries:
+  - docker.io
+  - ghcr.io
+  - gcr.io

.pre-commit-config.yaml

@@ -32,6 +32,53 @@ repos:
         types_or: [python, pyi]
         args: [--fix, --exit-non-zero-on-fix]
 
+  # ShellCheck - Shell script linting (all .sh files)
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.11.0.1
+    hooks:
+      - id: shellcheck
+        args: [--severity=warning]
+
+  # shfmt - Shell script formatting (all .sh files)
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.12.0-2
+    hooks:
+      - id: shfmt
+        args: [-i, '4', -ci]
+
+  # actionlint - GitHub Actions workflow linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint
+
+  # zizmor - GitHub Actions security analysis
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.22.0
+    hooks:
+      - id: zizmor
+        args: [--min-severity=low, --min-confidence=medium]
+
+  # hadolint - Dockerfile linting
+  - repo: https://github.com/AleksaC/hadolint-py
+    rev: v2.14.0
+    hooks:
+      - id: hadolint
+        args: [--failure-threshold, warning]
+
+  # ty - Astral type checking (local hook)
+  - repo: local
+    hooks:
+      - id: ty
+        name: ty type checking
+        entry: >-
+          bash -c 'for dir in common orchestrator fuzzer fuzzer_runner patcher program-model seed-gen; do
+          if [[ "$1" == "$dir/"* ]]; then cd "$dir" && uv run ty check src/; exit $?; fi; done' --
+        language: system
+        types: [python]
+        files: ^(common|orchestrator|fuzzer|fuzzer_runner|patcher|program-model|seed-gen)/src/
+        pass_filenames: true
+
 # Global exclusions for files that should never be checked
 exclude: |
   (?x)^(

.shellcheckrc

@@ -0,0 +1,6 @@
+# Shellcheck configuration for Buttercup
+shell=bash
+
+# Globally disable SC1091 (source file not followed)
+# These are dynamically sourced or external files
+disable=SC1091