feat(declare-bashscript): one trap handler, set with Set-Traps; bash 5.3; tests run by make check - #288

….3, errtrace and inherit_errexit (#268)

Phase 2 of the plan. The helper refuses bash older than 5.3 with EX_CONFIG before anything else runs, turns on
errtrace and inherit_errexit, and defines on_error_or_interrupt and Set-Traps. A script calls Set-Traps once, naming
its cleanup. A failure that ends it is reported once, in error's form, with its line and command, and exits with its
status; a failure it tolerates is not reported; HUP, INT and TERM end it with 129, 130 and 143; and the cleanup runs on
every way out. The man page gains a TRAPS section and states the bash requirement.

Probed on Danoble-MBP-A with bash 5.3.15 against this helper, every case in the plan's table, and macOS's /bin/bash
3.2.57 is refused with 78. Two behaviors of bash itself are written into the man page: a failing pipeline is reported
with its last command's text, and a function called as an if test runs past its own failure. The helper's getopt call,
131 columns, is wrapped at 120. No script calls Set-Traps yet: phase 4 here, then lanes 61 and 62.

… on ubuntu-26.04 (#268)

Phase 3 of the plan. tests/Test-DeclareBashScript runs 14 programs under the helper in a child bash and checks how each
ends: a failure at top level, inside a function, inside a command substitution, before the last command of one, inside
a subshell and in a pipeline is reported once with its status; a failure under set +o errexit, in an if test and
before || is not; SIGHUP, SIGINT and SIGTERM end the script with 129, 130 and 143 and run its cleanup; an error call
and a normal end run the cleanup too; and a bash older than 5.3, where one is at /bin/bash, is refused with 78. No copy
of the old handler is kept, as ruled.

A root Makefile, modeled on devlore-cli's, gives each gate CI runs a target, with the gate's reasons moved beside it
from the workflow, and make check runs them all and then the tests. CI moves to ubuntu-26.04, whose bash meets the
helper's floor where ubuntu-24.04's 5.2.21 does not, installs the same pinned tools, codespell among them, and calls
make check. make check passes on Danoble-MBP-A in 7.8 seconds; CI's own run comes with the pull request.

…d cleans up through Set-Traps (#268)

Phase 4 of the plan. scripts/setup-ground-zero.sh, the one bash file in this repository that traps, sources the
helper under the guard and the directive, parses its options with the helper's loop, and narrates with note, success,
error 0 for its warnings and error with a sysexits status for its failures. Its own colors, info, warn, error and
phase are gone, and its help text is the synopsis usage prints. The file it captures the Azure setup's output in is
removed by a cleanup that Set-Traps runs on every way out, where a trap set mid-script did before. Its Azure and GitHub
commands are unchanged.

Run on Danoble-MBP-A: --help exits 0; an unknown option, a missing --name and a stray argument exit 64; the dry run
read Azure and GitHub and stopped at the prerequisites with 69. The live path, which provisions Azure and configures
GitHub, was not run. Two old defects are fixed: a missing CLI's error exited before the line meant to record it, and
the secret count printed two lines when gh failed.

… needed, all passed (#268)

The deployed test ran as ruled for these tests, the branch checked out in the base layer's clone: writ deploy
--allow-dirty deployed 270 links (personal's clone held the inventory lists Upgrade-Mac writes), the deployed helper
carried Set-Traps, the 14 tests passed against it, and the 18 consumers deployed on Danoble-MBP-A whose code before
their option loop runs nothing exited 0 from --help. The clone went back to develop and was deployed again.

Every command substitution holding more than one command in the 72 scripts that source the helper was read for one
that relies on running past a failure, which inherit_errexit would stop: none. No launchd job or cron entry runs these
scripts here, where launchd's default PATH would hand them /bin/bash 3.2. The man page's lint, from phase 2, is ticked.
CI's own run comes with the pull request.

…itself (#268)

The plan stays active until they do, as agent-rules rule 12 asks a plan to say of a box that cannot close inside its
own pull request.