test: 🚨 exhaustive behavioral coverage for all scripts

[tomgrv]

Summary

• Replaced the syntax-only test.bats (previously just "installed on PATH + sh -n valid") in every one of the 53 script folders with a real behavioral suite: help/usage output, argument validation, error paths (missing/invalid args, running outside a git repo), success paths, and script-specific edge cases — run against throwaway git repos or temp directories via tests/helpers.bash.
• Suites are hermetic: no network access, no writes outside temp dirs (network-only paths, e.g. zz_npx/zz_update's real npm/git-remote fetches, are covered by asserting the local-fixture fast path and that no network call occurs).
• 417 tests now pass (npm test / bats --recursive .), up from the previous syntax-only checks.
• Writing real tests surfaced and fixed 8 pre-existing bugs (minimal fixes, same behavior otherwise):
  • load-json: error exit 1s were silently swallowed because they lived inside an if/elif block piped into sed | jq, and jq exits 0 on empty stdin.
  • git-fix-base, git-fix-children, git-fix-date, git-fix-message, git-fix-privacy, git-fix-secrets: several destructive-rewrite scripts checked zz_ask's exit code (if ! zz_ask ...) instead of its printed answer, so answering "n" to "This will rewrite history, continue?" never actually cancelled the operation.
  • git-fix-base: the -n dry-run heredoc declared an invalid shell variable name (dry-run), so the flag never worked.
  • git-fix-children: grep's "no match" exit code (a normal case: no descendant branches to delete) aborted the whole script under set -e.
• Updated the root README.md's Tests section to describe the new coverage.

Test plan

• npm test (bats --recursive .) — 417/417 passing
• Each modified script re-verified individually with npx bats <dir>/test.bats

---

Generated by Claude Code

[tomgrv]

validate-pr-title failed on the latest push, but not due to this PR's diff: the job fails in its actions/setup-node step with Dependencies lock file is not found ... Supported file patterns: package-lock.json,npm-shrinkwrap.json,yarn.lock — before the actual title-validation step even runs. This repo has never had a lockfile committed, and the same failure just hit an unrelated PR (#5, unrelated commit) too, while it passed earlier on this same PR's prior commit. That's a pre-existing, repo-wide CI infra gap (the workflow's npm-cache step needs a lockfile that doesn't exist), not something introduced here.

Re-ran the failed job once. If it stays red, the underlying fix (adding a committed lockfile, or dropping cache: npm from the workflow) is outside this PR's scope.

---

Generated by Claude Code