Defensive bash conventions: set -euo pipefail, ShellCheck-clean, function naming, error trapping, and POSIX portability.