feat(scripts): add shellspec installation to dfm (#296)

* feat(scripts): add shellspec installation to dfm

Add install-shellspec.sh script that clones shellspec to
~/.cache/shellspec and installs via make to ~/.local/bin.
Wire it into dfm install menu and the Tier 4 install-all pipeline.

* fix(scripts): address PR review feedback for shellspec installer

Add companion install-shellspec.md documentation file to match
codebase convention. Add --depth=1 to git pull for consistent
shallow clone behavior.

* fix(scripts): pin shellspec install to latest release tag

Use x-gh-get-latest-version to fetch the latest release tag from
GitHub and clone/checkout that specific version. Addresses supply
chain concern and normalizes --depth=1 style.

* docs(scripts): update shellspec docs to reflect release-tag pinning

scripts/install-shellspec.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# @description Install shellspec testing framework
+#
+# shellcheck source=shared.sh
+source "${DOTFILES}/config/shared.sh"
+
+SHELLSPEC_REPO="https://github.com/shellspec/shellspec.git"
+SHELLSPEC_CACHE="$HOME/.cache/shellspec"
+
+install_shellspec()
+{
+  local version
+  version=$(x-gh-get-latest-version shellspec/shellspec)
+  msgr ok "Latest shellspec version: $version"
+
+  if [[ -d "$SHELLSPEC_CACHE" ]]; then
+    msgr ok "shellspec repo already cloned, fetching $version..."
+    git -C "$SHELLSPEC_CACHE" fetch --depth=1 origin "refs/tags/$version"
+    git -C "$SHELLSPEC_CACHE" checkout "$version"
+  else
+    git clone --branch "$version" --depth=1 "$SHELLSPEC_REPO" "$SHELLSPEC_CACHE"
+  fi
+
+  msgr run "Running make install..."
+  make -C "$SHELLSPEC_CACHE" install PREFIX="$HOME/.local"
+  msgr run_done "shellspec $version installed to $HOME/.local/bin/shellspec"
+  return 0
+}
+
+main()
+{
+  install_shellspec
+  return 0
+}
+
+main "$@"