refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

lim/data/crypt.py

@@ -0,0 +1,24 @@
+"""Lock/unlock the encfs-encrypted data directory."""
+
+from lim import config, runner, ui
+
+
+def unlock() -> None:
+    ui.info(f"Unlocking directory {config.DECRYPTED_PATH}...")
+    if not config.DECRYPTED_PATH.is_dir():
+        ui.info(f"Creating directory {config.DECRYPTED_PATH}...")
+        config.DECRYPTED_PATH.mkdir()
+    ui.info(f"Decrypting directory {config.ENCRYPTED_PATH} to {config.DECRYPTED_PATH}...")
+    runner.run(["encfs", str(config.ENCRYPTED_PATH), str(config.DECRYPTED_PATH)])
+    print("ATTENTION: DATA IS NOW DECRYPTED!")
+
+
+def lock() -> None:
+    ui.info(f"Locking directory {config.DECRYPTED_PATH}...")
+    runner.run(
+        ["fusermount", "-u", str(config.DECRYPTED_PATH)],
+        error_msg="Unmounting failed.",
+    )
+    ui.info("Data is now encrypted.")
+    ui.info(f"Removing directory {config.DECRYPTED_PATH}...")
+    config.DECRYPTED_PATH.rmdir()