Guarantee public APIs under caller-selected Bash options

[codeforester]

Closes #216

Summary

• define and document the Bash 4.2+ caller-runtime contract across all eight errexit/nounset/pipefail combinations
• make every public module safe to source and exercise under caller-selected options without leaking changes to shell state
• validate arity before required positional expansion and make Bash 4.2 empty-array handling nounset-safe
• reject aliases and reserved internal names for caller-owned sources/results before locals or mutation
• preserve caller IFS, cwd, traps, option state, and transient cleanup ownership across file, Git, GitHub, argument, list, string, and std APIs
• run the standalone contract matrix in the existing digest-pinned, networkless Bash 4.2.53 CI container

Validation

• ./tests/validate.sh (383 BATS tests, smokes, examples, and all 8 option modes)
• ./tests/lint-warnings.sh
• focused std/arg/list/string/Git/GitHub suites
• adversarial readonly/dynamic-scope collision review
• git diff --check

Exact Bash 4.2.53 execution is intentionally delegated to this PR's pinned compatibility job.