Fix the two ShellCheck warnings and hold CI at that level

The workflow went in at severity: error on the assumption that a
never-linted repository would have a backlog worth grandfathering. It
did not -- error found nothing, and warning found exactly two things, so
the cautious setting was protecting against a problem that was not
there.

zimbra_backup.sh: SC2024, sudo does not affect redirects. The
`> "$BACKUP_FILE"` runs as root rather than as the sudo'd zimbra user,
so backups landed root-owned inside a directory the script deliberately
chowns to zimbra:zimbra. Kept the redirect -- root can always write
there, and piping into `tee` would put tee's status in $? and hide a
zmmailbox failure -- and handed ownership over explicitly afterwards.
The suppression is narrow and states why.

disk_cleanup.sh: SC2034, total_freed was assigned and never read.

CI now holds at warning with a clean tree, so anything that trips it is
new rather than inherited.

.github/workflows/shellcheck.yml

@@ -23,11 +23,12 @@ jobs:
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         with:
-          # Findings are reported but do not fail the build yet: the
-          # existing scripts have not been through a lint pass, so
-          # failing on day one would block every PR on pre-existing
-          # issues. Tighten to "error" -> "warning" -> remove once the
-          # backlog is cleared; see the audit in the README.
+          # warning, not error: the first run at this level surfaced
+          # exactly two findings and both were fixed, so there is no
+          # pre-existing backlog to grandfather in. Anything new that
+          # trips it is genuinely new. Dropping to the default (info)
+          # would also pull in style suggestions across every script --
+          # worth doing, but as its own pass.
           severity: warning
           check_together: 'yes'
           format: gcc