feat(languages): add bash/shell bundle

Shell-heavy projects had no bundle that fit. archangel and archsetup are bash repos, and installing elisp or python gave them the wrong language rules. I added languages/bash on the go bundle's shape.

The bundle ships bash.md and bash-testing.md rules, a PostToolUse hook that runs shellcheck on edited shell files and blocks on a violation, a shellcheck pre-commit githook, settings.json wiring, gitignore-add.txt, and a "Bash/shell project" CLAUDE.md. The hook covers .sh, .bash, and extensionless files with a shell shebang, since the CLI tools that fill a shell repo carry no extension. shellcheck is the gate. shfmt stays out of the blocking path because shell has no canonical formatting style, and forcing tabs-vs-spaces would impose a contested choice. Both the hook and the githook are shellcheck-clean against their own rule.

I extended the Makefile test target to discover languages/*/tests/*.bats, so the bundle's 8 hook tests run with the rest of the suite. The README bundle table was stale, listing elisp only. I corrected it to the five bundles now shipping.

2 files changed, 154 insertions, 0 deletions

diff --git a/languages/bash/claude/rules/bash-testing.md b/languages/bash/claude/rules/bash-testing.md
new file mode 100644
index 0000000..c904927
--- /dev/null
+++ b/languages/bash/claude/rules/bash-testing.md
@@ -0,0 +1,71 @@
+# Bash Testing Rules
+
+Applies to: `**/*.bats`
+
+Implements the core principles from `testing.md`. All rules there apply here —
+this file covers shell-specific patterns.
+
+## Framework: bats-core
+
+Use [bats-core](https://bats-core.readthedocs.io/) for shell tests. A test file
+is `<thing>.bats`; each test is a `@test "description" { ... }` block; a non-zero
+exit inside the block fails the test. Run a file with `bats path/to/file.bats`,
+or a tree with `bats -r tests/`.
+
+Drive the script under test with `run`: it captures `$status` (exit code),
+`$output` (combined stdout+stderr), and `$lines[]` (output split by line)
+without the failure aborting the test. Assert on those.
+
+```bash
+@test "greet: prints the name passed in" {
+  run bash "$SCRIPT" --name Ada
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Hello, Ada"* ]]
+}
+```
+
+## Test the Real Script, Through Its Interface
+
+Run the actual script file — never copy its logic into the test. Invoke it the
+way a caller does (`run bash "$SCRIPT" <args>`, or `run "$SCRIPT"` when it's
+executable) and assert on exit status and output. A test that re-implements the
+script's logic passes even when the script breaks.
+
+For a script that sources a library of functions, source the library in `setup`
+and call the functions directly — that's the unit level; the `run` invocation is
+the integration level.
+
+## Normal, Boundary, Error — the Three Categories
+
+Cover all three from `testing.md` per script:
+
+- Normal: the expected arguments and inputs produce the expected output and a
+  zero exit.
+- Boundary: empty argument, missing optional flag, single-item vs many,
+  whitespace and unicode in inputs, a path with a space.
+- Error: missing required argument, nonexistent input file, a dependency
+  absent. Assert the exit code and that the error names the problem — not the
+  exact wording (`testing.md`'s error-behavior rule).
+
+## Isolation and Determinism
+
+- `setup()` makes a fresh `mktemp -d` per test; `teardown()` removes it. No test
+  leans on another's leftovers, and tests pass in any order.
+- Mock an external command by putting a stub earlier on `PATH`: write a small
+  script named like the command into a temp dir, `chmod +x`, and prepend that
+  dir to `PATH` for the `run`. This is how you simulate a tool being absent,
+  returning an error, or emitting canned output — without touching the network
+  or the real tool.
+- Never hardcode dates; generate them relative to `date` (see the
+  `task-review-staleness.bats` pattern in this repo for relative-date fixtures).
+- Mock at the boundary (network, the external CLI, the clock). Don't mock the
+  script's own functions — those are the work.
+
+## What Not to Do
+
+- Don't assert exact error-message prose; assert the exit code plus a value the
+  message must contain.
+- Don't share mutable state between tests through a fixed temp path.
+- Don't test that `shellcheck` or `bats` themselves work — trust the tools.
+- Don't skip the error cases because the happy path passes; the error paths are
+  where shell scripts actually break.
diff --git a/languages/bash/claude/rules/bash.md b/languages/bash/claude/rules/bash.md
new file mode 100644
index 0000000..042138a
--- /dev/null
+++ b/languages/bash/claude/rules/bash.md
@@ -0,0 +1,83 @@
+# Bash Code Rules
+
+Applies to: `**/*.sh`, `**/*.bash`, and extensionless files with a `sh`/`bash` shebang
+
+Shell-specific style and structure. Pairs with `bash-testing.md` for tests and
+the generic `verification.md` / `commits.md` rules. When in doubt, defer to
+[ShellCheck](https://www.shellcheck.net/wiki/) (every SCxxxx code has a wiki
+page explaining the fix) and Google's
+[Shell Style Guide](https://google.github.io/styleguide/shellguide.html).
+
+## ShellCheck Is the Gate, Not a Suggestion
+
+The bundle's PostToolUse hook runs `shellcheck` on every edited shell file and
+blocks on a violation; the pre-commit hook re-checks staged files. ShellCheck
+catches the bugs that define shell: unquoted expansions that word-split, unset
+variables, `[ ]` pitfalls, masked exit codes. Fix the finding rather than
+silence it. When a warning is a genuine false positive, disable it narrowly with
+a `# shellcheck disable=SCxxxx` directive on the line above and a comment saying
+why, never a file-wide blanket disable.
+
+## The Header: Strict Mode
+
+Every script starts with `#!/usr/bin/env bash` and `set -euo pipefail`:
+
+- `-e` exits on an unhandled non-zero command. Handle the expected-failure cases
+  explicitly (`cmd || true`, an `if`, a `case`) so the exit is a real error.
+- `-u` treats an unset variable as an error. Use `"${VAR:-default}"` for the
+  ones that are legitimately optional.
+- `-o pipefail` makes a pipeline fail if any stage fails, not just the last.
+
+A script meant to be *sourced* (a library) skips `set -e` — it would change the
+caller's shell. Libraries guard their own commands instead.
+
+## Quote Everything
+
+- Double-quote every expansion: `"$var"`, `"$@"`, `"${arr[@]}"`,
+  `"$(command)"`. Unquoted is the single largest source of shell bugs — a path
+  with a space becomes two arguments.
+- `"$@"` (quoted) passes arguments through untouched; `$*` and unquoted `$@`
+  word-split. Use `"$@"` unless you specifically want the joined string.
+- Loop over arrays and `find -print0 | while IFS= read -r -d ''`, never over
+  unquoted command substitution or `ls` output.
+
+## Test, Compare, Branch
+
+- Use `[[ ]]` for tests, not `[ ]` / `test`. `[[ ]]` doesn't word-split its
+  operands, supports `&&`/`||`/`=~`, and has fewer quoting traps.
+- Arithmetic goes in `(( ))` or `$(( ))`, not `[ ]` with `-eq`.
+- `$(command)`, never backticks — nests cleanly and reads better.
+- Prefer `printf` over `echo` for anything but a fixed literal string;
+  `echo` mangles values that start with `-` or contain backslashes.
+
+## Functions and Scope
+
+- Declare function-local variables with `local`. A bare assignment in a
+  function writes a global and leaks across calls.
+- `local var; var="$(cmd)"` on two lines when you need the command's exit
+  status: `local var="$(cmd)"` masks `cmd`'s exit code behind `local`'s.
+- Keep functions focused. A function that fetches, parses, and writes is three
+  functions; the test difficulty in `bash-testing.md` is the tell.
+- Put `main "$@"` at the bottom for a script with more than a couple of
+  functions, so definition order doesn't dictate execution order.
+
+## Robustness
+
+- `trap 'rm -rf "$tmpdir"' EXIT` right after creating a temp resource, so
+  cleanup runs on every exit path including errors.
+- Make a temp file or dir with `mktemp` / `mktemp -d`, never a fixed
+  `/tmp/name` (race + collision).
+- Check that a required command exists before the work: `command -v jq
+  >/dev/null || { echo "jq required" >&2; exit 1; }`.
+- Never parse `ls` output and don't `cat` a file into a pipe you could read
+  directly. Glob, or use `find`, or read the file in place.
+
+## What Not to Do
+
+- Don't leave an expansion unquoted to "save a quote" — quote it.
+- Don't use `[ ]` when `[[ ]]` is available, or backticks when `$()` is.
+- Don't silence a ShellCheck warning file-wide to clear it; fix it or disable
+  the one code with a reason.
+- Don't refactor surrounding code while fixing a bug — keep the diff scoped.
+- Don't commit credentials or API keys — the pre-commit hook catches common
+  patterns but isn't a substitute for care.