refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

tests/unit/test_image_session.py

@@ -0,0 +1,62 @@
+from lim.device import Device
+from lim.image.session import ImageSession
+
+
+def test_partition_paths_for_sd_card():
+    session = ImageSession(Device("mmcblk0"))
+    assert session.boot_partition_path == "/dev/mmcblk0p1"
+    assert session.root_partition_path == "/dev/mmcblk0p2"
+    assert session.root_mapper_path == "/dev/mmcblk0p2"
+
+
+def test_decrypt_root_on_luks_partition(fake_runner):
+    fake_runner.outputs["-s TYPE"] = "crypto_LUKS"
+    fake_runner.outputs["-s UUID"] = "uuid-1"
+    session = ImageSession(Device("sda"))
+    session.decrypt_root()
+    assert session.root_mapper_name == "linux-image-manager-uuid-1"
+    assert session.root_mapper_path == "/dev/mapper/linux-image-manager-uuid-1"
+    assert len(fake_runner.find("cryptsetup", "luksOpen", "/dev/sda2")) == 1
+
+
+def test_decrypt_root_skips_plain_partition(fake_runner):
+    fake_runner.outputs["-s TYPE"] = "ext4"
+    session = ImageSession(Device("sda"))
+    session.decrypt_root()
+    assert session.root_mapper_name is None
+    assert session.root_mapper_path == "/dev/sda2"
+    assert fake_runner.find("cryptsetup") == []
+
+
+def test_destructor_unmounts_everything_despite_failures(tmp_path, fake_runner):
+    session = ImageSession(Device("sda"))
+    session.working_folder = tmp_path
+    session.boot_mount_path = tmp_path / "boot"
+    session.root_mount_path = tmp_path / "root"
+    fake_runner.failures.add("umount")  # every umount fails; cleanup must go on
+
+    session.destructor()
+
+    umounted = [cmd[-1] for cmd in fake_runner.find("umount")]
+    root = str(session.root_mount_path)
+    # chroot binds first (deepest path first), then the partitions
+    assert umounted == [
+        f"{root}/dev/pts",
+        f"{root}/dev",
+        f"{root}/proc",
+        f"{root}/sys",
+        f"{root}/boot",
+        root,
+        str(session.boot_mount_path),
+    ]
+    removed = [cmd[-1] for cmd in fake_runner.find("rmdir")]
+    assert removed == [root, str(session.boot_mount_path), str(tmp_path)]
+
+
+def test_destructor_closes_luks_mapper(tmp_path, fake_runner):
+    fake_runner.outputs["-s TYPE"] = "crypto_LUKS"
+    fake_runner.outputs["-s UUID"] = "uuid-1"
+    session = ImageSession(Device("sda"))
+    session.decrypt_root()
+    session.destructor()
+    assert len(fake_runner.find("luksClose", "linux-image-manager-uuid-1")) == 1