Add bats-core unit tests

Start with src/scripts/lib/*.sh to understand the listed functions, then review .github/workflows/test-runner.yaml and the existing shell lint configuration. Add isolated Bats tests under tests/ using sandboxed environment variables and stub binaries; run them with bats tests/ and the existing lint checks. Done means the specified library targets have unit coverage, a fast CI job runs it, and the README explains local testing.

Context

~80 bash scripts with zero unit tests. src/scripts/lib/*.sh define sourced, reusable functions — ideal unit targets — but the only automated coverage is slow, container-based integration (test-runner.yaml cli/config/full/master jobs) plus post-run scripts/validate*.sh gates. No fast feedback loop exists for lib logic.

Spec

1. Tooling

• Install bats-core locally (release tarball) plus bats-support / bats-assert / bats-file.
• Layout: tests/lib/<name>.bats mirroring src/scripts/lib/, tests/helpers/setup.bash (sandbox/stub loader), tests/stubs/ (fake binaries), tests/fixtures/ (package lists, dotfiles trees, manifest lines).

2. Unit-test targets (source lib, call in isolation)

• src/scripts/lib/dotfiles-install.sh — expand_home_path, copy_dotfile_file, link_dotfiles_xdg_config_dirs, install_dotfiles_from_manifest: sandbox HOME/XDG_CONFIG_HOME, assert copy idempotency, backup-then-symlink of pre-existing ~/.config/<app>.
• src/scripts/lib/package-install.sh — append_packages_from_file, install_pacman_packages_from_file(s), install_collected_*, install_aur_packages*: stub pacman on PATH, fixture lists, assert invocation args and continuation-on-failure.
• src/scripts/lib/aur-repo-add.sh / aur-repos.sh — add_arch_repo_if_missing, setup_repo_from_manifest_line, add_pacman_repos_parallel: stub pacman/git; assert idempotency (no duplicate repo entries).
• src/scripts/lib/run.sh / env.sh — ensure_temp_dir, run_script: TEMP_DIR defaulting, best-effort (|| true) exit tolerance.
• src/scripts/lib/parallel.sh — parallel_run_best_effort, parallel_wait_pids, parallel_wait_pids_best_effort: pid log bookkeeping, failure aggregation.
• src/scripts/lib/zsh-login.sh (zsh_login_safe, ensure_zshrc_login_safe), git-submodules.sh (ensure_submodules_synced with a sandbox git repo), gnome-session.sh (gnome_session_active with a fake dbus-send/gnome-shell).

3. Approach

• setup() per test: mktemp -d sandbox; export HOME, TEMP_DIR, PROJECT_ROOT into it; prepend tests/stubs/ to PATH. No network, no real system mutation.
• Exclude leaf installers (src/scripts/install/**) — guarded one-liners already exercised by container CI.

4. CI

• Add a fast unit-tests job (ubuntu-latest, no docker) to .github/workflows/test-runner.yaml before the container jobs: checkout → setup bats → bats tests/. Use bats-core/bats-action pinned to the full-length commit SHA of its latest release (repo pinning convention), passing BATS_LIB_PATH from its lib-path output.
• Extend lint:shell-style globs so tests/** .bats/helpers are covered by the existing shellcheck/shfmt quality gate.

5. Docs

• README "Testing" section: local bats install + bats tests/; note unit vs. container-integration split.

Out of scope

Leaf script side effects, container integration jobs, scripts/validate*.sh gates.