ci: Check every Compose file and shell script, and test Jaeger and the executor - #1489

Closes three gaps in CI: it validated only the base Compose file, did not lint the shell scripts, and never deployed Jaeger or the executor.

• Validates every Compose file, in each combination the docs tell customers to run: db-only, Jaeger, dev, the executor (with the base file, and alone), every example override, and the combination the smoke test starts.
• Runs shellcheck on every *.sh file and the Buildkite hook. shellcheck 0.11.0 goes in .tool-versions, which is now sorted by name.
• Deploys Jaeger and the executor in the smoke test. smoke-test.sh starts the base file with jaeger/ and executors/, and checks that the Jaeger UI answers. Then executor-smoke-test.sh, which CI never ran, checks that the executor registers and serves exactly the queues batches, batches-hooks, and codeintel.
• Adds all three to AGENTS.md.

What the new checks found

• executor.docker-compose.yaml failed when run alone, as executors/README.md describes: service "executor" refers to undefined network sourcegraph. It now declares the network. This is the only change customers can see.
• dev/run.sh and its README called docker-compose (v1). They now use docker compose.
• .buildkite/vagrant-run.sh assigned and exported DOCKER_PASSWORD in one statement, which hides a failed gcloud call (SC2155).

Risk: low. CI and dev tooling, plus the network declaration above.

Things to know

• The CI agent has Compose 2.18.1, which accepts the !override and !reset tags in three examples but ignores them. For those three, CI checks that the file parses, not that the merged result is right.
• The VM installs jq before the executor test, because the VM image lacks it.
• Not covered: traces reaching Jaeger, and the executor running a job.

Checklist

• All images have a valid tag and SHA256 sum (no image changes)

Test plan

• Build 16953 passed: the Compose step, the shellcheck step, and both tests ran. The smoke test log has Executor serves the queues batches,batches-hooks,codeintel and EXECUTOR SMOKE TEST PASSED
• Every command in validate-docker-compose.sh passes on Compose 2.18.1 and 5.7.1
• The queue check, with stub curl and docker commands: three queues pass in any order; two, four, or none fail and print the names found; no executor fails after 120 seconds

Closes FE-589