Fix the two ShellCheck warnings and hold CI at that level

The workflow went in at severity: error on the assumption that a
never-linted repository would have a backlog worth grandfathering. It
did not -- error found nothing, and warning found exactly two things, so
the cautious setting was protecting against a problem that was not
there.

zimbra_backup.sh: SC2024, sudo does not affect redirects. The
`> "$BACKUP_FILE"` runs as root rather than as the sudo'd zimbra user,
so backups landed root-owned inside a directory the script deliberately
chowns to zimbra:zimbra. Kept the redirect -- root can always write
there, and piping into `tee` would put tee's status in $? and hide a
zmmailbox failure -- and handed ownership over explicitly afterwards.
The suppression is narrow and states why.

disk_cleanup.sh: SC2034, total_freed was assigned and never read.

CI now holds at warning with a clean tree, so anything that trips it is
new rather than inherited.

zimbra_backup.sh

@@ -57,10 +57,17 @@ echo "📦 Starting backup..."
 # $EMAIL arrives as a positional argument instead. Interpolating it (as
 # this line previously did) let any shell metacharacter in the address
 # run commands as the zimbra user, which owns the whole mail store.
+# The redirect is performed by this shell, which is root -- not by the
+# sudo'd zimbra process. That is intentional (root can always write
+# here, and a pipe into `tee` would put tee's exit status in $? and mask
+# a zmmailbox failure), but it means the file lands root-owned inside a
+# directory chowned to zimbra, so ownership is handed over below.
+# shellcheck disable=SC2024
 sudo -u zimbra bash -c '/opt/zimbra/bin/zmmailbox -z -m "$1" getRestURL "//?fmt=tgz"' _ "$EMAIL" > "$BACKUP_FILE"
 
 # Verify success
 if [ $? -eq 0 ]; then
+    chown zimbra:zimbra "$BACKUP_FILE" 2>/dev/null || true
     echo "✅ Backup completed: $BACKUP_FILE"
 else
     echo "❌ Backup failed. Check if the user exists or zmmailbox is working."