fix(lint): fix all sonarcloud detected issues (#279)

* fix(ci): replace broad permissions with specific scopes in workflows

Replace read-all/write-all with minimum required permission scopes
across all GitHub Actions workflows to follow the principle of least
privilege (SonarCloud rule githubactions:S8234).

* fix(shell): use [[ instead of [ for conditional tests

Replace single brackets with double brackets in bash conditional
expressions across 14 files (28 changes). All scripts use bash
shebangs so [[ is safe everywhere (SonarCloud rule shelldre:S7688).

* fix(shell): add explicit return statements to functions

Add return 0 as the last statement in ~46 shell functions across
17 files that previously relied on implicit return codes
(SonarCloud rule shelldre:S7682).

* fix(shell): assign positional parameters to local variables

Replace direct $1/$2/$3 usage with named local variables in _log(),
msg(), msg_err(), msg_done(), msg_run(), msg_ok(), and array_diff()
(SonarCloud rule shelldre:S7679).

* fix(python): replace dict() constructor with literal

Use {} instead of dict() for empty dictionary initialization
(SonarCloud rule python:S7498).

* fix(shell): fix husky shebang and tolerate npm outdated exit code

* docs(shell): add function docstring comments

* fix(shell): fix heredoc indentation in x-sonarcloud

* feat(python): add ruff linter and formatter configuration

* fix(ci): align megalinter config with biome, ruff, and shfmt settings

* fix(ci): disable black and yaml-prettier in megalinter config

* chore(ci): update ruff-pre-commit to v0.15.0 and fix hook name

* fix(scripts): check for .git dir before skipping clone in install-fonts

* fix(shell): address code review issues in scripts and shared.sh

- Guard wezterm show-keys failure in create-wezterm-keymaps.sh
- Stop masking git failures with return 0 in install-cheat-purebashbible.sh
- Add missing shared.sh source in install-xcode-cli-tools.sh
- Replace exit 1 with return 1 in sourced shared.sh

* fix(scripts): address code review and security findings

- Guard wezterm show-keys failure in create-wezterm-keymaps.sh
- Stop masking git failures with return 0 in install-cheat-purebashbible.sh
- Add missing shared.sh source in install-xcode-cli-tools.sh
- Replace exit 1 with return 1 in sourced shared.sh
- Remove shell=True subprocess calls in x-git-largest-files.py

* style(shell): apply shfmt formatting and add args to pre-commit hook

* fix(python): suppress bandit false positives in x-git-largest-files

* fix(python): add nosemgrep suppression for check_output call

* feat(format): add prettier for YAML formatting

Install prettier, add .prettierrc.json config (200-char width, 2-space
indent, LF endings), .prettierignore, yarn scripts (lint:prettier,
fix:prettier, format:yaml), and pre-commit hook scoped to YAML files.

* style(yaml): apply prettier formatting

* fix(scripts): address remaining code review findings

- Python: use list comprehension to filter empty strings instead of
  slicing off the last element
- create-wezterm-keymaps: write to temp file and mv for atomic updates
- install-xcode-cli-tools: fix shellcheck source directive path

* fix(python): sort imports alphabetically in x-git-largest-files

* fix(lint): disable PYTHON_ISORT in MegaLinter, ruff handles it

* chore(git): add __pycache__ to gitignore

* fix(python): rename ambiguous variable l to line (E741)

* style: remove trailing whitespace and blank lines

* style(fzf): apply shfmt formatting

* style(shell): apply shfmt formatting

* docs(plans): add design documents

* style(docs): add language specifier to fenced code block

* feat(lint): add markdown-table-formatter to dev tooling

Add markdown-table-formatter as a dev dependency with yarn scripts
(lint:md-table, fix:md-table) and a local pre-commit hook to
automatically format markdown tables on commit.

local/bin/msgr

@@ -23,21 +23,25 @@ CLR_RESET="\033[0m"
 #  │ Color functions                                          │
 #  ╰──────────────────────────────────────────────────────────╯
 
+# Wrap text in red color
 function __color_red()
 {
   local MSG="$1"
   echo -e "${CLR_RED}${MSG}${CLR_RESET}"
 }
+# Wrap text in yellow color
 function __color_yellow()
 {
   local MSG="$1"
   echo -e "${CLR_YELLOW}${MSG}${CLR_RESET}"
 }
+# Wrap text in green color
 function __color_green()
 {
   local MSG="$1"
   echo -e "${CLR_GREEN}${MSG}${CLR_RESET}"
 }
+# Wrap text in blue color
 function __color_blue()
 {
   local MSG="$1"
@@ -48,36 +52,43 @@ function __color_blue()
 #  │ Helpers                                                  │
 #  ╰──────────────────────────────────────────────────────────╯
 
+# Print blue arrow marker
 function __log_marker()
 {
   echo -e "${CLR_BLUE}➜${CLR_RESET}"
 }
 
+# Print green checkmark marker
 function __log_marker_ok()
 {
   echo -e "${CLR_GREEN}✔${CLR_RESET}"
 }
 
+# Print blue checkmark marker
 function __log_marker_ok_blue()
 {
   echo -e "${CLR_BLUE}✔${CLR_RESET}"
 }
 
+# Print yellow warning marker
 function __log_marker_warn()
 {
   echo -e "${CLR_YELLOW}⁕${CLR_RESET}"
 }
 
+# Print yellow question marker
 function __log_marker_question()
 {
   echo -e "${CLR_YELLOW}?${CLR_RESET}"
 }
 
+# Print red error marker
 function __log_marker_err()
 {
   echo -e "${CLR_RED}⛌${CLR_RESET}"
 }
 
+# Print indentation spacing
 function __log_indent()
 {
   echo "    "
@@ -87,71 +98,85 @@ function __log_indent()
 #  │ Log functions                                            │
 #  ╰──────────────────────────────────────────────────────────╯
 
+# Print a message with arrow marker
 function msg()
 {
   echo -e "$(__log_marker) $1"
 }
 
+# Print a celebration message
 function msg_yay()
 {
   echo -e "🎉 $1"
 }
 
+# Print a celebration message with checkmark
 function msg_yay_done()
 {
   echo -e "🎉 $1 ...$(__log_marker_ok)"
 }
 
+# Print a message with completion checkmark
 function msg_done()
 {
   echo -e "$(__log_marker) $1 ...$(__log_marker_ok)"
 }
 
+# Print a completion checkmark suffix
 function msg_done_suffix()
 {
   echo -e "$(__log_marker) ...$(__log_marker_ok)"
 }
 
+# Print a prompt-style message
 function msg_prompt()
 {
   echo -e "$(__log_marker_question) $1"
 }
 
+# Print a prompt message with checkmark
 function msg_prompt_done()
 {
   echo -e "$(__log_marker_question) $1 ...$(__log_marker_ok)"
 }
 
+# Print an indented message
 function msg_nested()
 {
   echo -e "$(__log_indent)$(__log_marker) $1"
 }
 
+# Print an indented message with checkmark
 function msg_nested_done()
 {
   echo -e "$(__log_indent)$(__log_marker) $1 ...$(__log_marker_ok)"
 }
 
+# Print a running-task message in green
 function msg_run()
 {
   echo -e "${CLR_GREEN}➜ $1${CLR_RESET} $2"
 }
 
+# Print a running-task message with checkmark
 function msg_run_done()
 {
   echo -e "${CLR_GREEN}➜ $1${CLR_RESET} $2 ...$(__log_marker_ok)"
 }
 
+# Print an ok/success message
 function msg_ok()
 {
   echo -e "$(__log_marker_ok) $1"
 }
 
+# Print a warning message
 function msg_warn()
 {
   echo -e "$(__log_marker_warn) $1"
 }
 
+# Print an error message
 function msg_err()
 {
   echo -e "$(__log_marker_err) $1"
@@ -174,6 +199,7 @@ ask()
 # If this is being sourced, no need to run the next steps.
 [ "$sourced" = 1 ] && return
 
+# Run visual tests for all message types
 function __tests()
 {
   msg "[ msg ]"
@@ -192,6 +218,7 @@ function __tests()
   msg_yay_done "[ yay_done ]"
 }
 
+# Show usage information and examples
 function usage()
 {
   echo "usage: msgr [type] [message] [optional second message]"