refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

tests/unit/test_fsutil.py

@@ -0,0 +1,35 @@
+import pytest
+
+from lim import fsutil
+from lim.errors import LimError
+
+
+def test_replace_in_file_replaces_all_occurrences(tmp_path):
+    target = tmp_path / "conf"
+    target.write_text("MODULES=()\nHOOKS=(base)\nMODULES=()\n")
+    fsutil.replace_in_file("MODULES=()", "MODULES=(x)", target)
+    assert target.read_text() == "MODULES=(x)\nHOOKS=(base)\nMODULES=(x)\n"
+
+
+def test_replace_in_file_fails_when_search_missing(tmp_path):
+    target = tmp_path / "conf"
+    target.write_text("nothing here\n")
+    with pytest.raises(LimError):
+        fsutil.replace_in_file("MODULES=()", "MODULES=(x)", target)
+    assert target.read_text() == "nothing here\n"
+
+
+def test_ensure_line_appends_once(tmp_path):
+    target = tmp_path / "fstab"
+    target.write_text("existing entry\n")
+    assert fsutil.ensure_line_in_file("new entry", target) is True
+    assert fsutil.ensure_line_in_file("new entry", target) is False
+    assert target.read_text() == "existing entry\nnew entry\n"
+
+
+def test_ensure_line_creates_file_and_handles_missing_newline(tmp_path):
+    target = tmp_path / "crypttab"
+    assert fsutil.ensure_line_in_file("first", target) is True
+    target.write_text("no newline at end")
+    assert fsutil.ensure_line_in_file("second", target) is True
+    assert target.read_text() == "no newline at end\nsecond\n"