harden update script and add bats CI coverage

tests/shell/git_update.bats

@@ -0,0 +1,52 @@
+#!/usr/bin/env bats
+
+setup() {
+  REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
+  SCRIPT_PATH="$REPO_ROOT/git_update.sh"
+  TMP_ROOT="$BATS_TEST_TMPDIR/work"
+  mkdir -p "$TMP_ROOT/bin"
+}
+
+@test "git_update.sh can be sourced without running main" {
+  run bash -lc "source '$SCRIPT_PATH' >/dev/null 2>&1; echo sourced"
+  [ "$status" -eq 0 ]
+  [[ "$output" == "sourced" ]]
+}
+
+@test "resolve_configured_php_bin accepts command name from PATH" {
+  cat >"$TMP_ROOT/bin/php84" <<'SH'
+#!/usr/bin/env sh
+exit 0
+SH
+  chmod +x "$TMP_ROOT/bin/php84"
+
+  run bash -lc "PATH='$TMP_ROOT/bin':\$PATH; source '$SCRIPT_PATH'; resolve_configured_php_bin 'php84' 'php'"
+  [ "$status" -eq 0 ]
+  [ "$output" = "php84" ]
+}
+
+@test "resolve_configured_php_bin rejects unknown custom command" {
+  run bash -lc "PATH='$TMP_ROOT/bin'; source '$SCRIPT_PATH'; resolve_configured_php_bin 'does-not-exist' 'php'"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"Configured PHP binary 'does-not-exist' is not executable/resolvable."* ]]
+}
+
+@test "enforce_php_requirement passes for satisfied constraint" {
+  cat >"$TMP_ROOT/composer.json" <<'JSON'
+{"require":{"php":">=8.0"}}
+JSON
+
+  run bash -lc "cd '$TMP_ROOT'; source '$SCRIPT_PATH'; enforce_php_requirement php"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"PHP requirement check passed"* ]]
+}
+
+@test "enforce_php_requirement fails for unsatisfied constraint" {
+  cat >"$TMP_ROOT/composer.json" <<'JSON'
+{"require":{"php":">=99.0"}}
+JSON
+
+  run bash -lc "cd '$TMP_ROOT'; source '$SCRIPT_PATH'; enforce_php_requirement php"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"PHP requirement check failed"* ]]
+}