feat: Refine batch script linting (#2016)

src/image.sh

@@ -935,9 +935,9 @@ reportBatchMatches() {
 checkBatch() {
 
   local file="$1"
-  local report="N"
   local tmp output
   local matches line
+  local enabled_rules
 
   [ -s "$file" ] || return 0
 
@@ -949,42 +949,26 @@ checkBatch() {
   local source="your install.bat file"
   [ -n "${COMMAND:-}" ] && source="your COMMAND variable"
 
+  # Only check rules that indicate likely execution or behavioural failures.
+  enabled_rules="E001,E002,E003,E004,E005,E006,E007,E008"
+  enabled_rules+=",E009,E010,E011,E012,E013,E014,E015,E016"
+  enabled_rules+=",E017,E018,E019,E020,E021,E022,E023,E024"
+  enabled_rules+=",E025,E027,E028,E029,E030,E031,E032,E033,E034"
+  enabled_rules+=",W004,W005,W013,W017,W021,W022,W034,W038,W040"
+
   if enabled "$DEBUG"; then
-
-    report="Y"
-
     if LC_ALL=C grep -Pq '[^\x09\x0D\x20-\x7E]' "$file"; then
       warn "non-ASCII characters were detected in $source and may not execute correctly in Windows Command Prompt."
     fi
-
-  else
-
-    # First pass: silently check only for Error-level findings.
-    cat > "$tmp/blinter.ini" <<'EOC'
-[general]
-min_severity = error
-EOC
-
-    if ! (
-      cd "$tmp"
-      python3 -m blinter "$file" >/dev/null 2>&1
-    ); then
-      report="Y"
   fi
 
-  fi
+  cat > "$tmp/blinter.ini" <<EOC
-
-  if enabled "$report"; then
-
-    # Show useful diagnostic context, while excluding findings that are
-    # irrelevant to unattended OEM scripts.
-    cat > "$tmp/blinter.ini" <<'EOC'
 [general]
 min_severity = warning
 show_summary = false
 
 [rules]
-disabled_rules = W001,W025,W028,W033,W041,SEC002,SEC005
+enabled_rules = $enabled_rules
 EOC
 
   output=$(
@@ -992,7 +976,7 @@ EOC
     python3 -m blinter "$file" 2>&1 || true
   )
 
-    # Remove header
+  # Remove header.
   output=$(
     awk '
       /^DETAILED ISSUES:/ {
@@ -1024,8 +1008,6 @@ EOC
     printf '\n%s\n\n' "$output" >&2
   fi
 
-  fi
-
   rm -rf "$tmp" || true
 
   reportBatchMatches \