ci(shellcheck): drop SC2155 + clear SC2006 in demoLibrary.source (C3a) (openemr#156)

PR C3a of the ratchet cleanup. Closes out SC2006 (rc-wide) and
SC2155 (file-level) for docker/scripts/demoLibrary.source. SC2086
in this file is C3b's bulk SC2086 audit; the file-level disable is
trimmed but not removed.

SC2006 (4 sites, mechanical):
  - L91, L162, L284:  local MYSQLIP=`docker inspect ...`
  - L285:             local currentTime=`date "+..."`
  All converted to $(...) form.

SC2155 (4 sites, surfaced after SC2006 fix):
  Same code positions as the SC2006 fix above. Once the backticks
  became $(...), shellcheck's "local x=$(cmd) masks return value"
  finding became visible. Same masked-warning pattern as the SC2002
  fold-in we hit in C2 (cat-in-grep mask).

  Fix: split into two statements (declare separately, then assign).
  Now if `docker inspect` or `date` fails, the assignment carries
  the real exit code instead of being masked by `local`'s exit code.

  Note on the rc estimate: .shellcheckrc said "(4 violations)" for
  SC2155 but with SC2006 still active, shellcheck reported 0 SC2155
  violations directly. The 4 became visible only after C3a's SC2006
  fix, which is why this commit "closes out" both checks together
  rather than handling SC2155 as a separate concern.

  Side note: the rc estimate matched the actual count exactly (4) --
  the comment was right, the count just wasn't reachable until
  SC2006 was cleaned.

.shellcheckrc:
  - SC2155 dropped (the only remaining rc disable -- file is now clean
    except for the file-level SC2086 directive that C3b will retire).

docker/scripts/demoLibrary.source file-level directive:
  - Trimmed from `disable=SC2086,SC2006,SC2155` to `disable=SC2086`.
    C3b will remove the directive entirely once the 72 SC2086 sites
    are individually fixed.

Verification:
  - shellcheck repo-wide -- clean.
  - build-tests dry-run suite -- 7/7 PASS.
  - auto-derive fixture suite -- 8/8 PASS.

State after this PR: .shellcheckrc is empty of disables (only
external-sources=true remains). The file-level disable on
demoLibrary.source is the last remaining scoped ratchet.

Refs: openemr#146 (parent), openemr#149 + openemr#150 + openemr#151 + openemr#152 (prior ratchet PRs)

Assisted-by: Claude Code

Author: bradymiller

.shellcheckrc

@@ -12,6 +12,3 @@
 # cleaned up. This repo isn't there yet.
 
 external-sources=true
-
-# Pre-existing bash warnings deferred to follow-up cleanup PRs.
-disable=SC2155  # declare and assign separately (4 violations) -- masks return values

docker/scripts/demoLibrary.source

@@ -9,12 +9,13 @@
 #
 # Bash library for openemr demo farm
 #
-# Per-file shellcheck ratchet (issue #146 cleanup PR C2): the 80 SC2086 /
-# SC2006 / SC2155 violations in this file are deferred to PR C3. The
-# file-level disable here lets C2's drop of the repo-wide SC2086 +
-# SC2006 disables land cleanly; C3 will fix each site individually and
-# remove this directive.
-# shellcheck disable=SC2086,SC2006,SC2155
+# Per-file shellcheck ratchet (issue #146 cleanup, post-C2 + C3a):
+# the 72 SC2086 violations in this file remain deferred to PR C3b.
+# C3a closed out SC2006 (4 sites) and SC2155 (4 sites — surfaced after
+# SC2006 fix at the same code positions, same masked-warning pattern
+# as C2's SC2002 fold-in). C3b will fix each SC2086 site individually
+# and remove this directive.
+# shellcheck disable=SC2086
 
 # This is the wrapper to start the demo, so only need to modify the specifics in 1 place
 # rather than 2. Picks the right flex image + instance count per cluster, then
@@ -87,7 +88,8 @@ startDemoWrapper() {
 # 1st parameter is the demo name (one, two, three, etc.)
 # 2nd parameter is the mysql root password
 stopDemo () {
-    local MYSQLIP=`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr`
+    local MYSQLIP
+    MYSQLIP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr)
 
     # Stop the docker
     echo "Stop ${1}-openemr docker"
@@ -158,7 +160,8 @@ startDemo () {
 # 2nd parameter is the demo subname (a, b, c, etc.)(also can be 'empty' which is for the main subdemo)
 # 3rd parameter is the mysql root password
 restartSubdemo () {
-    local MYSQLIP=`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr`
+    local MYSQLIP
+    MYSQLIP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr)
 
     # Remove the database stuff
     if [ "$2" == "empty" ]; then
@@ -280,8 +283,10 @@ renewLetsencrypt () {
 # 2nd parameter is the demo subname (a, b, c, etc.)(also can be 'empty' which is for the main subdemo)
 # 3rd parameter is the mysql root password
 snapshotDemo() {
-    local MYSQLIP=`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr`
-    local currentTime=`date "+%Y-%m-%d-%H-%M-%S"`
+    local MYSQLIP
+    MYSQLIP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-openemr)
+    local currentTime
+    currentTime=$(date "+%Y-%m-%d-%H-%M-%S")
     local snapshotName="${1}-${2}-${currentTime}"
     local capsules=~/capsules
     local tmp="${capsules}/tmp"