distill: overflow-safe ZIP bounds check (#784) + env-bash shebangs (#674)

Two independent review distills sharing src/cli/cli.c, kept as two separate commits on one branch to avoid conflicts.

Commit 1 — 7b93210 fix(cli): overflow-safe ZIP entry bounds check in self-update extraction

Distilled from #784 (thanks @SS-42, co-authored). Refs #784-review.

The real fix (title, not buried): the self-update ZIP truncation check

if (header_end + (int)comp_size > data_len) { break; }

is bypassable for comp_size >= 2^31: the int cast turns the size negative, the sum drops below data_len, and the entry is accepted — authorizing inflate to read up to ~4 GB past the downloaded archive buffer (strm.avail_in = comp_size). Replaced with the overflow-safe, strictly tighter

if (header_end > data_len || comp_size > (uint32_t)(data_len - header_end)) { break; }

Regression guard (red-first, verified via temporary revert of the check):
cli_extract_binary_from_zip_rejects_truncated_deflate_size_over_int_max builds a 52-byte archive whose only entry claims comp_size = 0xFFFF0000 (DEFLATE, uncomp_size = 1, self-terminating 3-byte stream).

• RED on the old check (verbatim):

  cli_extract_binary_from_zip_rejects_truncated_deflate_size_over_int_max  FAIL tests/test_cli.c:1399: accepted a truncated deflated zip entry with a wrapped compressed size
  

  Pre-fix failure mode: the negative-int bypass admits the entry, zlib is handed avail_in = 0xFFFF0000 (licensed to read ~4 GB past the buffer); the fixture's DEFLATE stream self-terminates, so extraction succeeds and returns non-NULL — a deterministic assertion failure rather than an ASan-dependent crash, in both directions: the fixed check rejects the entry (NULL), the old one accepts it (non-NULL).
• GREEN with the fix: cli + cypher suites 258 passed, 0 failed.

Secondary cppcheck cleanups from the same review (audited behavior-neutral):

• zip_read_u16le/zip_read_u32le little-endian helpers replacing the inline shift pyramids (behavior-identical).
• zip_extract_entry sizes widened to size_t with an explicit UINT_MAX guard before the zlib uInt narrowing.
• cypher.c eval_condition: removed genuinely unreachable IS NULL / IS NOT NULL null guards (resolve_condition_value result is early-returned on NULL just above); cypher_*_is_null tests unchanged and green.

Commit 2 — 50392a4 fix(scripts): use /usr/bin/env bash shebangs (NixOS has no /bin/bash)

Distilled fresh from #674 (thanks @SuperSandro2000, co-authored). Refs #674-review.

• Converted #!/bin/bash → #!/usr/bin/env bash in the eleven scripts/*.sh holdouts, test-infrastructure/run.sh, and the three Claude Code hook scripts emitted by src/cli/cli.c (gate, session reminder, and the subagent reminder added since Use /usr/bin/env bash for widely compatible shebang #674 was opened).
• Parser-test coverage preserved (deliberate divergence from Use /usr/bin/env bash for widely compatible shebang #674): the infra_parse_shell* fixtures in tests/test_pipeline.c intentionally keep #!/bin/bash, so absolute-path shebang extraction (r.shebang == "/bin/bash") stays covered. tests/repro fixtures untouched. No test asserts the emitted hook scripts' shebang, so no assertion updates were required.
• Replaced the GitHub-PAT-shaped fixture string flagged in the Use /usr/bin/env bash for widely compatible shebang #674 thread with ghp_FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE — obviously fake, still ghp_ + 36 alnum so the secret detector (pass_infrascan.c) keeps firing; envscan_secret_value_exclusion green.
• bash -n clean on all 12 changed scripts.

Verification (after both commits)

• make -f Makefile.cbm cbm — -Werror clean.
• make -f Makefile.cbm lint-ci — cppcheck, clang-format, NOLINT check all green.
• test-runner pipeline — 209 passed, 0 failed.
• test-runner cli cypher — 258 passed, 0 failed.

Refs #784-review, refs #674-review.