sota-shell-scriptinglisted

# SOTA Shell Scripting Purpose: produce shell scripts that survive contact with reality — unusual filenames, missing commands, partial failures, hostile input, signals, and concurrent invocation — and audit existing scripts for the defect classes that cause most production shell incidents: unquoted expansions, silent error swallowing, injection, secret leakage, and temp-file races. Bash-focused (bash 5.x current; macOS ships bash 3.2 and defaults to zsh — see portability rules). POSIX `sh` only when the target demands it (busybox/dash containers, init systems). ## First decision: should this be shell at all? **Do NOT use shell when any of these hold.** Recommend Python/Go (or the project's primary language) instead, and say so explicitly in BUILD and AUDIT output: - Script exceeds ~100 lines of actual logic (not counting boilerplate/usage text). - Needs real data structures (nested maps, JSON manipulation beyond a `jq` one-liner, sets). - Needs granular error handling (retry *this* step, distinguish error kinds, partial rollback). - Does arithmetic beyond integers, date math, or float comparison. - Parses structured formats (JSON/YAML/XML) with string surgery instead of `jq`/`yq`. - Needs portable concurrency beyond "run N jobs and `wait`". - Is security-critical input handling (auth, parsing untrusted network data). Shell is the right tool for: gluing processes together, CI steps, container entrypoints, small install/deploy wrappers, environment setup — anything that i