refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

tests/unit/test_catalog.py

@@ -0,0 +1,24 @@
+from lim import catalog
+
+
+def test_catalog_contains_all_sections():
+    assert catalog.arch_rpi_images()
+    assert catalog.manjaro_gnome_releases()
+    assert catalog.retropie_images()
+    assert catalog.mkinitcpio_modules_by_rpi()
+
+
+def test_arch_entries_are_complete():
+    for version, entry in catalog.arch_rpi_images().items():
+        assert entry["image"], version
+        assert entry["luks_memory_cost"].isdigit(), version
+
+
+def test_mkinitcpio_covers_every_arch_rpi_version():
+    assert set(catalog.mkinitcpio_modules_by_rpi()) == set(catalog.arch_rpi_images())
+
+
+def test_manjaro_entries_have_url_and_image():
+    for release, entry in catalog.manjaro_gnome_releases().items():
+        assert entry["url"].startswith("https://"), release
+        assert entry["image"], release