refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

tests/unit/test_verify.py

@@ -0,0 +1,52 @@
+import hashlib
+
+import pytest
+
+from lim.errors import LimError
+from lim.image import verify
+
+CONTENT = b"fake image content"
+
+
+@pytest.fixture
+def image(tmp_path):
+    path = tmp_path / "image.img"
+    path.write_bytes(CONTENT)
+    return path
+
+
+@pytest.mark.parametrize("algorithm", ["md5", "sha1", "sha256", "sha512"])
+def test_matching_checksum_passes(image, algorithm):
+    checksum = hashlib.new(algorithm, CONTENT).hexdigest()
+    verify.verify_checksum(image, checksum)
+
+
+def test_uppercase_checksum_passes(image):
+    checksum = hashlib.sha256(CONTENT).hexdigest().upper()
+    verify.verify_checksum(image, checksum)
+
+
+def test_wrong_checksum_raises(image):
+    checksum = hashlib.sha256(b"other content").hexdigest()
+    with pytest.raises(LimError):
+        verify.verify_checksum(image, checksum)
+
+
+def test_unrecognized_digest_length_raises(image):
+    with pytest.raises(LimError):
+        verify.verify_checksum(image, "abc123")
+
+
+def test_missing_checksum_is_skipped(image):
+    verify.verify_checksum(image, None)  # must not raise
+
+
+def test_resolve_checksum_takes_first_available(fake_runner):
+    fake_runner.success_by_fragment["image.img.sha1"] = False
+    fake_runner.success_by_fragment["image.img.sha512"] = True
+    fake_runner.outputs["-q -O -"] = "deadbeef  image.img"
+    assert verify.resolve_checksum("https://example.org/image.img") == "deadbeef"
+
+
+def test_resolve_checksum_returns_none_without_sources(fake_runner):
+    assert verify.resolve_checksum("https://example.org/image.img") is None