feat: validate executable shell scripts

[Tom Meschter (tmeschter)]

Summary

• Add the reusable npm run check:shell-scripts command that verifies tracked shebang-bearing .sh files have Git mode 100755.
• Run the same check in PR CI after installing the scripts dependencies.
• Keep the validation logic shared between local development and GitHub Actions.

Per-skill executable-bit changes are provided in separate PRs.

Related to #2958

[Copilot]

Pull request overview

This PR addresses #2958 by ensuring tracked, shebang-bearing .sh scripts intended for direct invocation are executable in Git, and by adding a CI/local check to enforce that going forward.

Changes:

• Added a git ls-files-based permission validator (npm run check:shell-scripts) and wired it into PR CI.
• Updated contributor guidance to document the executable-bit workflow for shell scripts.
• Adjusted several skill/recipe scripts (including Foundry and validate flows) as part of making direct-execution scripts consistent.

Show a summary per file

File	Description
scripts/src/check-shell-script-permissions.ts	New script that validates executable Git mode for tracked shebang .sh files.
scripts/package.json	Adds a runnable checkShellScriptPermissions script entry.
package.json	Adds root-level check:shell-scripts convenience command.
.github/workflows/pr.yml	Adds a PR CI job to enforce shell script executable modes.
.github/copilot-instructions.md	Documents executable-bit expectation and adds the check to the PR checklist table.
plugins/azure-skills/skills/microsoft-foundry/scripts/check-and-setup-dependencies.sh	Foundry helper script; part of the set of directly-invoked shell scripts.
plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/scripts/generate_deployment_url.sh	Script to generate Foundry portal deployment URLs.
plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/query_capacity.sh	Script to query model capacity for regions/SKUs.
plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh	Script to discover/rank regions by capacity/quota/projects.
plugins/azure-skills/skills/microsoft-foundry/foundry-agent/toolbox/scripts/get-catalog-inputs.sh	Toolbox script to query MCP catalog inputs and auth signals.
plugins/azure-skills/skills/microsoft-foundry/foundry-agent/create/scripts/verify-environment.sh	Preflight environment verifier for hosted-agent creation.
plugins/azure-skills/skills/microsoft-foundry/foundry-agent/create/scripts/resolve-project-id.sh	Resolves Foundry project ARM IDs from project endpoints.
plugins/azure-skills/skills/microsoft-foundry/foundry-agent/create/scripts/check-copilot-app-entry.sh	Copilot app agent preflight for optional plugin installation.
plugins/azure-skills/skills/azure-validate/references/scripts/workflow.sh	Step-by-step helper for the azure-validate workflow.
plugins/azure-skills/skills/azure-validate/references/scripts/scan-aspire-functions-secrets.sh	Pre-provision scan for Aspire + Functions secret-storage configuration.
plugins/azure-skills/skills/azure-validate/references/recipes/azd/scripts/set-aspire-aca-env.sh	Recipe script to populate missing env vars after azd provision.
plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh	Quota inspection helper meant to be invoked directly.
plugins/azure-skills/skills/azure-prepare/references/services/sql-database/scripts/grant-sql-access.sh	Recipe hook script to grant SQL access via managed identity.
plugins/azure-skills/skills/azure-diagnostics/scripts/aks-baseline.sh	Read-only AKS diagnostic sweep script.
plugins/azure-skills/skills/azure-deploy/references/recipes/azd/scripts/grant-and-migrate.sh	Recipe script to grant SQL access and apply EF migrations.
plugins/azure-skills/skills/azure-deploy/references/recipes/azd/scripts/apply-migrations.sh	Recipe script to apply EF migrations via managed identity.
plugins/azure-skills/skills/azure-app-onboard/scaffold/scripts/scaffold-conformance.sh	Conformance gate script for scaffolded IaC validation.

Review details

• Files reviewed: 5/22 changed files
• Comments generated: 2
• Review effort level: Lite