Safer scripts: set -euo pipefail, trap, input validation, shellcheck

By default Bash is forgiving: if a command fails, the script carries on, an unset variable quietly becomes an empty string, and a failure early in a pipeline is ignored. That tolerance turns small mistakes into big damage, such as a script that runs rm -rf "$dir/"* when dir was never set. Defensive scripting habits prevent this, and Linux+ expects you to recognize them in code and choose the right one for a described problem.