[quality] Zero unit coverage: build_files/shared/build.sh and system_files profile.d scripts

[kubestellar-hive]

Finding

After bluefin#1175 (.github/scripts/validate-docs.py), bluefin#1162 (install-hooks.sh, worktree.sh) and bluefin#1168 (ghcurl), the following shipped scripts still have zero unit coverage — no BATS file in tests/unit/ and no Python test in tests/ references them:

Script	Lines	Risk
build_files/shared/build.sh	63	Build-stage orchestrator — a regression breaks every image variant.
system_files/shared/etc/profile.d/90-bluefin-starship.sh	23	Runs in every interactive login shell; a bad branch breaks user shells.
system_files/shared/etc/profile.d/91-bluefin-aliases.sh	6	Same blast radius, trivial to cover.

scripts/check-testsuite-workflow-ref.py is already tracked separately in #1169 and is deliberately excluded here.

Recommendation

1. tests/unit/build_test.bats — sandbox build_files/shared/build.sh, stub the scripts it dispatches to, and assert stage ordering, variant/flavor argument handling, and non-zero propagation when a stage fails.
2. tests/unit/profile_d_test.bats — source each profile.d script in a sandboxed shell and assert the guard conditions (non-interactive shell, missing starship binary, NO_COLOR/TERM handling) leave the environment untouched rather than erroring.

Both land in the existing bats tests/unit/ run (just test-unit, and the Run unit tests step in pr-validation.yml), so no workflow change is required.

Priority

• Impact: medium (build.sh is high blast radius; profile.d is high frequency, low complexity)
• Effort: low

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 47ab367

— hive: agent=quality backend=copilot model=claude-opus-5