Normalize .sh file modes across the repo #127

Split out of #125, where the exec bits were restored rather than normalized to keep that branch comment-only.

Current state

git ls-tree -r master on the seven tracked shell scripts:

Five 755, two 644, with no rule distinguishing them — the two 644 files are a init-plugins.sh and a init-firewall.sh whose 755 counterparts sit in sibling directories.

Why it currently doesn't matter

No script in this repo is executed via its committed exec bit:

• Both init-plugins.sh are templates that consumers invoke as bash .devcontainer/init-plugins.sh from postCreateCommand.
• ralphex-fe/init.sh and init-docker.sh are COPY'd and then explicitly chmod +x'd at ralphex-fe/Dockerfile:154.
• patch-playwright-mcp.sh is COPY'd to /usr/local/bin/patch-playwright-mcp and made executable in the image.
• init-firewall.sh is invoked by the devcontainer's postCreateCommand/initializeCommand chain, not by path execution.

So this is cosmetic today. It became visible because #125 flipped two of them 755 → 644 without anyone noticing — the mode change is invisible to a "did any content line change" review, and git diff only shows it in the header.

Proposal

Pick one rule and apply it repo-wide:

• 755 everywhere — matches the majority and matches intuition for a file with a shebang.
• 644 everywhere — arguably more honest, since nothing depends on the bit and every consumer either prefixes bash or chmod +xs during build.

Either is fine; the value is having a rule. Worth a line in .claude/CLAUDE.md under Code Style once chosen, so it doesn't drift again.

Optional follow-up: a git config core.fileMode note, or a CI check asserting the modes, if this recurs.