test(manifest): cover the installer's integrity surface (backend#1729 sweep 6)

[LukasWodka]

Sweep 6 is "mutation-check the existing suites". Measuring first: of the 24
shell scripts under scripts/ (excluding tests), exactly TWO are referenced
by no bats suite -- check-style.sh and gen-manifest.sh. Client is in good
shape; this closes the one that matters most.

gen-manifest.sh produces scripts/manifest.sha256, which install.sh
verifies every fetched sub-script against BEFORE running privileged steps.
It is the installer's integrity surface, and nothing proved its guards
fire.

It carries three claims in its own comments. All three are TRUE -- worth
stating, since this epic is largely a record of such claims being false:

1. gen-manifest's FILES must match install.sh's FILES, "or vice versa"
2. the same for install.ps1's $Files
3. --check is non-zero on drift

What was missing is any test that would notice them ceasing to be true.
Both cross-checks are awk extractions of another file's array literal --
precisely the parser that goes quietly stale when the parsed file is
reformatted. 12 cases now pin them, including both stale-parser cases:
rename install.sh's array and the guard must REFUSE, not compare nothing
to nothing and agree.

ONE REAL GAP FOUND AND FIXED. Emptying FILES makes the manifest cover
nothing, and --check then compared an empty manifest to an empty
regeneration. It did fail -- on set -u's "FILES[@]: unbound variable".
A failure by accident, whose message says nothing about the integrity
surface just lost. Now refused explicitly, naming the consequence: "an
empty manifest verifies nothing".

The first version of that guard used ${#FILES[@]}, which is ITSELF an
unbound-variable error on an empty array under bash 3.2 -- what macOS
ships and what this repo deliberately targets. So the guard reproduced,
by a different route, the exact unintelligible failure it was written to
replace. It now uses ${arr[*]-}, which expands safely whether the array
is unset, empty or populated. Caught by running it on bash 3.2, not by
reading it.

Also in the suite: a case asserting the COMMITTED manifest lists every
file install.sh fetches. That guards the premise rather than the
mechanism -- if the manifest were current AND short, every other test
here could pass while a fetched script had no digest at all.

12/12 pass; bats-hygiene passes, so every assertion is load-bearing
rather than advisory.

Remaining from the measurement: check-style.sh has no suite. Filed rather
than bundled -- one self-contained change per PR.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

---

Note

Low Risk
Changes strengthen supply-chain CI checks and installer manifest generation; no runtime auth or data-path behavior changes beyond clearer failure on misconfiguration.

Overview
Adds scripts/tests/gen-manifest.bats to exercise gen-manifest.sh --check against copied scripts/ trees: lockstep with install.sh FILES and install.ps1 $Files, non-zero drift when hashes or files are wrong, and fail-closed behavior when those arrays can’t be parsed.

gen-manifest.sh now refuses an empty FILES or WINDOWS_FILES surface with a clear integrity message instead of failing indirectly under set -u (or agreeing on an empty manifest during --check). A final test asserts the committed manifest.sha256 lists every path both bootstraps fetch.

^{Reviewed by Cursor Bugbot for commit b9176c1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b9176c1. Configure here.}