[s2x]

What changed

bin/lint.sh was Linux-x86_64-only in practice and failed confusingly on a clean
clone without vendor/.

• Replaced the xargs -0 -r pipelines with bash loops
  (run_shellcheck / run_hadolint) that keep a sticky failure status, so one
  clean file cannot mask an earlier failure and BSD/macOS xargs is not needed.
• Added an actionable vendor/ preflight before any PHP tool: composer install
  (or bin/worktree-setup.sh) is named and the script exits 1.
• Guarded the .lint-tools.env source with a readable-check and a clear error.
• Made the missing/older tool hints platform-aware: Linux x86_64 keeps the
  checksum-verifying install command, macOS gets brew install <tool> plus the
  release link, other platforms are pointed at the release asset (CI pins Linux
  x86_64).
• AGENTS.md/README.md state the supported hosts and the fail-fast behaviour;
  CHANGELOG.md records the fix under [Unreleased]/Fixed.

Closes #163

How it was tested

• bash -n bin/lint.sh, shellcheck bin/lint.sh .lint-tools.env,
  actionlint .github/workflows/ci.yml, git diff --check pass.
• PATH=/tmp/opencode/bin:$PATH bin/lint.sh passes on Linux.
• Temp copies: missing vendor/ prints the composer install message and exits
  1 before PHP tools; missing .lint-tools.env prints the clear error.
• Temp git repo with a deliberately broken .sh and a bad Dockerfile reports
  Failed: shellcheck hadolint and exits 1; a clean repo exits 0.
• Simulated uname for Linux x86_64, Darwin arm64/Intel and Linux arm64; each
  hint matches the platform. A bash:3.2 container confirms the new constructs
  work on macOS's system bash.

Checklist

• Tests added or updated, and all checks pass
• CHANGELOG.md updated under [Unreleased]
• Documentation updated
• Everything is written in English
• The PR title is a Conventional Commit (fix: ...)