Enforce thin-wrapper-only shell and port the remaining bats suites #334

Summary

Turn on the 200-line limit for Bash once the ports are in, and port the remaining bats suites that test workflows and configuration.

Work

• A shared payload gate that fails on any Bash script over 200 source lines, counted by tools/script_lines.py. No allowlist or baseline; it lands only when everything passes (the mise-bootstrap decision from Port the tools/ and release scripts #332 settles the one known case).
• Port the bats suites no other issue owns: tests/workflows (check-preset-refs, release, rust-msrv, sarif, security, skill-scanner), tests/config/starter-vocabulary.bats, tests/scripts/clear-commit-agentmsg.bats, tests/tasks suites left after the payload ports, and tests/test_helper.bash.
• Port the shared Bash support for the skill workflow suites alongside their callers: tests/skills/agent-merge-pr/test_helper.bash, tests/skills/agent-pr/test_helper.bash, tests/skills/merge-pr/gh-merge.bash, tests/skills/merge-pr/test_helper.bash, tests/skills/pr/test_helper.bash, and tests/skills/redesign.bash. These helpers belong to this issue; the inventory in docs(inventory): refresh the shell migration inventory and owners #754 records that ownership.
• Measure mise run test and the bats share before and after, against the baseline in docs/script-inventory.md (92 s total, bats 97.5%).
• File the consumer follow-ups Evaluate every Bash script and bats suite: port to Go or Python, or optimize, with a 200 SLOC limit #203 lists once devtools ships the replacements.

Acceptance

• The gate runs in mise run lint and in the shared payload.
• Before and after timings recorded.