All tracked .sh files were stored as mode 100644 (non-executable), even
though the CI workflow and normal usage invoke several of them directly
(./scripts/build.sh) rather than through `bash`. On a fresh Linux
checkout this fails with a permission error.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bash equivalent of the PowerShell manifest module: sync_managed_destination
plus its read/write/hash helpers, using sha256sum and a TSV manifest so
the same idempotent-install, stale-detection, and local-modification
protection behavior is available without a PowerShell dependency.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds Sync-ManagedDestination and its manifest helpers: a per-destination
TSV of path -> SHA-256 that makes installation idempotent (unchanged files
are neither rewritten nor backed up), detects files this setup previously
installed that the source no longer ships (removed after backup, unless
changed locally, in which case they are backed up and left in place with
a warning), and never touches a file it never installed. Backups for a
run land together under backups/<stamp>/ instead of one suffix per file.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>