All tracked .sh files were stored as mode 100644 (non-executable), even
though the CI workflow and normal usage invoke several of them directly
(./scripts/build.sh) rather than through `bash`. On a fresh Linux
checkout this fails with a permission error.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bash equivalent of the PowerShell managed-manifest test, covering the same
idempotency, stale-removal, modified-file-protection, foreign-file, and
side-effect-free dry-run scenarios against sync_managed_destination.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>