Add regression tests for bin/env-set.sh + bin/compose-file.sh (bats/shellspec)

[CybotTM]

PR #21 added two operator-facing shell helpers:

• bin/env-set.sh KEY [VALUE] — idempotent .env mutator
• bin/compose-file.sh add|remove|list PATH... — manipulates COMPOSE_FILE

Both have non-trivial edge cases (atomic .env rewrite, newline rejection in VALUE, quoted-value parsing, path validation, BSD-vs-Linux stat). They're currently only smoke-tested manually during PR development (~14 cases each, run in an ephemeral tmpdir).

Adding a proper test harness:

• catches regressions when we extend the scripts (e.g. when issue Generalize Make overlay toggles to traefik / caddy / observability #23 generalizes overlay toggles, the path-validation guard might need broadening)
• gives a CI signal for shell-script changes that today only get shellcheck

Implementation options:

• bats-core — fits Linux + macOS, ergonomic, runs in CI via the bats-core/bats-action GitHub action
• shellspec — richer DSL but heavier dependency

Recommend bats-core for minimal install footprint.

Test cases to cover (from manual smoke):

• env-set: add new key, replace existing key, BSD/macOS stat fallback (stat -f '%Lp'), atomic mv (tmp file in same dir, not /tmp), newline rejection, empty VALUE clears key, missing .env produces clean error, .env mode preserved (0600)
• compose-file: add idempotent (no duplicates), add multi-path, remove leaves clean .env when last overlay gone, list outputs current set, path validation rejects /tmp/* and ../*, hand-edited COMPOSE_FILE = "x:y" (quoted, spaces) round-trips correctly

Acceptance:

• tests/bin/ directory with bats specs
• New CI job runs bats against bin/
• All current smoke cases covered

Background: independent code-reviewer recommendation on PR #21.