executable_bit

Assert every file in scope either has the +x bit set (require: true) or does not (require: false).

- id: ci-scripts-exec
  kind: executable_bit
  paths: "ci/**/*.sh"
  require: true
  level: warning

No fix op — chmod auto-apply is deferred.