Opcode v1.1.0

Maintenance and tooling release (no corpus or app-behavior change).

- README: auto-tracking GitLab release badge; the four sources are now a
  linked bullet list, including Web-Security-Academy-Series.
- scripts/setup.sh: refactored to the no-subshell guide — parameter
  expansion over string-op subshells, one responsibility per function,
  main as the only orchestrator; stays bash-3.2 safe.
- CI: shellcheck job gating scripts/setup.sh.
- Docs: no-subshell reference guide and the matching AGENTS.md rules.