refactor(just): rename groups to Dev, CI, Admin

Part of #4709 ## Problem `build_files/` contains 10+ shell scripts that are never validated with ShellCheck locally. Bugs in these scripts are only caught at container build time (30-90 min cycle). ## Proposal ~~Add a `just validate-scripts` top-level recipe.~~ **Updated:** This should be an internal helper folded into `just lint` (#4712), not a separate top-level command. Having both `lint` and `validate-scripts` at the top level adds command sprawl. Implementation: `just lint` includes a shellcheck step for `build_files/**/*.sh`. No separate top-level recipe needed. ## Acceptance Criteria - [ ] ShellCheck runs on all `.sh` files in `build_files/` as part of `just lint` - [ ] Exits non-zero on any findings - [ ] Not a separate top-level recipe (internal to lint)