review-bashlisted

# Review Bash Correctness and security review for shell. Shell fails quietly and destructively: the same script works for months and then deletes the wrong directory the first time a variable is empty. The checklist runs whether or not `shellcheck` is installed. ## Procedure Follow `../../references/procedure.md`. Probe, scope, run what exists, walk the checklist by hand, score per `../../references/rubric.md`, emit both artifacts. ## Capability probe ```bash command -v shellcheck command -v shfmt ``` | Tool | Invocation | If absent | |---|---|---| | `shellcheck` | `shellcheck -S style <files>` | `apt install shellcheck` / `brew install shellcheck` | | `shfmt` | `shfmt -d <files>`, with `-i <n>` set to the project's indent width | `go install mvdan.cc/sh/v3/cmd/shfmt@latest` | Several missing at once? The suite ships `review-tools.sh`, which probes and installs the whole toolchain in one pass. **Name it in `## Checks skipped` and leave running it to the user** — a review reports, it does not install. `bash -n <file>` is the always-available floor — `bash` is the interpreter under review, so it is present by definition. It only catches syntax errors, so it is a floor and not a substitute. `shellcheck` exits non-zero when it finds problems; that is a result. Exit 127, or a complaint about an unsupported shebang, is a crash and belongs in `## Checks skipped`. ## Checklist | ID | Look for | Why it matters | Fix direction | |---|---|---|---| | **SH-01** | Any `$VAR` or