fix: a shebang and the execute bit go together, in every directory that documents a command (#856)

CHANGELOG.md

@@ -35,6 +35,41 @@ true until the next version shipped.
 
 ### Fixed
 
+- A shebang and the execute bit go together, and every directory that documents
+  a command is swept (#856). Two things were left over from #852.
+
+  **The rule flagged both states, so a sourced fragment could not be correct.**
+  It reddened a file that declared an interpreter without the bit, and it also
+  reddened a file with no interpreter line at all. Its header documented the way
+  out as "drop its shebang and say why", and that way out did not exist: dropping
+  the shebang moved the file from one red to the other. `bench/cb_guards.sh` is
+  the file that proved it -- sourced by `bench/run_clickbench.sh` and
+  `test/bench_guards.sh`, its header saying "Sourced, not executed" since it was
+  written, and unfixable under the old rule. `CONTEXT.md` had described the rule
+  correctly all along, as failing "if one has either without the other"; it was
+  the code that was stricter than the documented rule.
+
+  The rule is now that biconditional, and a file with neither a shebang nor the
+  bit passes.
+
+  **That removed the exemptions.** `test/selftest/` and `test/fixtures/` were
+  pruned by path because the old rule would have reddened them wholesale.
+  Measured under the new one before the prune came out: `selftest/` is 31 scripts
+  and every one is already correct, `fixtures/` is 14 `.sh`/`.py` of which 13 are
+  the host tools this change gives the bit. Nothing is excluded now, so nothing
+  is concealed.
+
+  **`bench/` joins the population.** `docs/benchmarks.md` names five `bench/`
+  scripts as bare commands. All five are executable today, so all five work:
+  correct by habit with nothing checking it, which is what `test/` was before
+  #852.
+
+  **A third check, anchored on the documents, closes the hole the biconditional
+  opens.** Delete a documented command's shebang and its bit and the file is
+  internally consistent and still broken for a reader, so neither of the first
+  two rules can see it. The third requires every script a document names to be
+  executable.
+
 - No compiled Python artifact is tracked, and the tree ignores the ones the
   interpreter writes (#854). `test/__pycache__/ste_check.cpython-312.pyc` was
   tracked. Its source, `test/ste_check.py`, was renamed to

CONTEXT.md

@@ -166,15 +166,26 @@ and ends with `pgc_summary`.
 - Register every suite in `SUITES` in `test/run_all_versions.sh`. That array is
   **one name per line and sorted**; insert in sorted position, never at the end.
   `harness_selftest` fails if the order decays.
-- **A script is executable and declares its interpreter on line 1.**
-  `harness_selftest` sweeps every `.sh` and `.py` under `test/`, at any depth,
-  and fails if one has either without the other. Both halves are needed. The
-  matrix starts a suite as `bash test/<name>.sh`, which never reads the mode, so
-  only the documentation and a reader's shell ever see it: 103 scripts were
-  100644 when this rule was written, and 30 documented commands died with
-  `Permission denied` (#852). `test/selftest/` and `test/fixtures/` are exempt,
-  and only those two. Their contents are sourced or imported rather than run, so
-  the bit would advertise a way to run them that does not work.
+- **A script is executable and declares its interpreter on line 1, or it has
+  neither.** `harness_selftest` sweeps every `.sh` and `.py` under `test/` and
+  `bench/`, at any depth, with nothing excluded, and fails if one has either
+  without the other. A file with neither is a fragment meant to be sourced, and
+  that is the only self-consistent way to say so. The matrix starts a suite as
+  `bash test/<name>.sh`, which never reads the mode, so only the documentation
+  and a reader's shell ever see it: 103 scripts were 100644 when this rule was
+  written, and 30 documented commands died with `Permission denied` (#852).
+- **And a script a document names as a bare command must exist and be
+  executable**, whatever its first line says. Both halves: a named path that has
+  been deleted or moved gives a reader `No such file or directory`, which is the
+  same defect as `Permission denied` in a different coat. That is the one check anchored on prose, and it
+  is deliberately over-inclusive: it exists because a file that has lost both its
+  shebang and its bit is internally consistent and still broken for the reader,
+  so the sweep above cannot see it (#856).
+- The population is every directory that holds a documented entry point, which
+  today is `test/` and `bench/`. `docs/benchmarks.md` names five `bench/` scripts
+  as bare commands; before #856 nothing checked them, which is exactly what
+  `test/` was before #852. A new directory that documents a command belongs in
+  the sweep the day it is added.
 - Count suites by asking the runner, never by parsing the source:
   `bash test/run_all_versions.sh --list-suites | wc -l`. A text parser over the
   array disagrees with bash on exactly the mistake this invites, and the

bench/cb_guards.sh

@@ -1,4 +1,3 @@
-#!/usr/bin/env bash
 #
 # Guards for the ClickBench harness (#465).
 #