test(Scripts): harden retained tooling foundation

[kyleve]

Summary

• pin ShellCheck 0.11.0, discover every tracked shebang-based shell file, and gate it in GitHub Actions and CircleCI
• extract TLA+ manifest validation, TLC argv/result policy, and summaries into an importable Python module with direct tests
• make attribution, region generation, and agent synchronization import-safe and directly testable
• add the behavior-first contract ledger in Tools/ADVERSARIAL_TEST_PLAN.md plus public-command portability tests
• make retained wrappers parse help and usage errors before touching Git, mise, interpreters, devices, or the network
• add a default-off CircleCI pipeline parameter for explicitly validating a stacked branch tip in a clean VM

Why

The Swift migration proved that direct tests and typed boundaries reduce tooling risk, but rewriting every command created too much code and bootstrap complexity. This first, independently reversible phase applies those lessons to the retained shell/Python/Ruby stack.

Review focus

• public tla-check behavior remains in shell while Java-free policy tests exercise Tools/tla_check.py
• interrupted/checksum-failed downloads never publish a partial TLC jar, and concurrent first-time downloads converge safely
• RegionGenerator reproduces the committed regions.json and all 54 GeoJSON files byte-for-byte
• all public --help paths work from an unrelated Unicode/spaced directory with minimal PATH, redirected HOME/TMPDIR, and LC_ALL=C
• manual_full_gate is default-off and runs the existing CircleCI workflow unchanged only when explicitly requested

⚠️ Breaking changes

None.

Compatibility

Public command paths and arguments are unchanged. Python remains system Python 3.9; Ruby runs through the pinned mise Ruby; retained shell passes Apple Bash 3.2 and ShellCheck.

Testing

• 29 Python tests
• 15 Ruby tests / 212 assertions
• public help/usage tests for all 20 root commands under minimal environment overrides
• TLC checksum, interrupted-download, and concurrent-cache command tests
• byte-identical region generation and write-failure tests
• circleci config validate .circleci/config.yml
• ./shellcheck
• ./swiftformat --lint
• ./attribution --check
• ./snapshot-shards check
• Apple Bash 3.2, system Python 3.9.6, and pinned Ruby 3.4.10 portability probes

Stack

First PR in the four-layer script-tooling hardening stack.