feat(shell): shell and Make deploy commands DEPLOYS what they apply

A script or Make recipe running kubectl apply, helm upgrade or a kustomize
build piped into kubectl puts manifests, a kustomization or a chart on a
cluster, and none of it was an edge: "which script deploys this manifest"
had no answer in the graph.

A new pass (the Bash + Make layer, run at the end of the K8s pass) reads
scripts and Makefiles that name a deploy tool and links, to existing nodes
only:
- kubectl apply|create|replace -f: the File of a manifest, a directory's
  manifests (-R: below it too), a glob's; -k: the Kustomization;
- kustomize build D (or kubectl kustomize D) | ... | kubectl apply -f -:
  the Kustomization of D;
- helm install|upgrade [NAME] CHART, helm template piped into kubectl:
  the Chart of a chart dir, else the shared external Chart of repo/name or
  oci://.../name;
- find D -name G -exec kubectl apply -f {} \;: D's matching manifests.
The edge starts at the bash function or Make rule running the command,
top-level code at its file, with via (kubectl / helm / kustomize), the
deployed path or chart, and the line.

Words are evaluated by constant propagation, nothing is executed:
assignments (local / export / readonly / declare, arrays), ${X:-default},
$0 / BASH_SOURCE, $(dirname ..), $(cd .. && pwd), $(realpath ..),
$(git rev-parse --show-toplevel); cd / pushd / popd track the directory.
Anything else is unknown, and an unknown target is no edge: a value set in
a branch or loop is unknown after it, a subshell's changes do not leak, an
unquoted unknown word that may shift helm's positionals blocks the chart.
With no directory tracked, a relative path resolves against the root and
the script's directory, linked only when exactly one of them has a target.
Make: the Makefile's variables expand into each recipe line ($(shell pwd) /
$(CURDIR) = the Makefile's directory; a conditional's value is unknown),
which is then read as a shell line.

Measured on 17 repositories against an independent reading of the scripts
(its own tokenizer, variable and directory tracking, the file system): 86
of 86 deploys linked, 86 of 86 correct (k8s.io 66, kubermatic 12, gardener
8). Only DEPLOYS edges and 3 external Charts were added; three runs build
identical graphs; index time unchanged within 1 s (deckhouse 10 s, gardener
5-6 s, k8s.io 3-4 s, median of 3). Nine incremental edits (deploy lines
edited, removed and added, a Makefile, a deployed manifest, a new manifest
and a new non-manifest in an applied directory) leave the graph a fresh
index builds.

tree-sitter-bash folds `a | b` followed by a line `cat <<EOF | c` into
`a | (b cat | c)`; that shape continues the outer pipe.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/check-lsp-originality.sh

@@ -74,10 +74,15 @@ REFS=(
   "kustomize|https://github.com/kubernetes-sigs/kustomize|api/krusty,api/internal/target"
   "flux|https://github.com/fluxcd/pkg|kustomize"
   "kube|https://github.com/kubernetes-sigs/controller-tools|pkg"
+  # The Bash (+ Make) layer (deploy commands, constant propagation) was written
+  # from the bash, GNU make, kubectl and helm documentation. Scanned against
+  # bash-language-server (MIT), the leading OSS bash language server.
+  "bash|https://github.com/bash-lsp/bash-language-server|server/src"
 )
 
 # Infrastructure hybrid LSP sources outside internal/cbm/lsp/ (scanned too).
-INFRA_SRC=(internal/cbm/extract_k8s.c src/pipeline/pass_k8s.c src/pipeline/pass_operator.c)
+INFRA_SRC=(internal/cbm/extract_k8s.c src/pipeline/pass_k8s.c src/pipeline/pass_operator.c
+           src/pipeline/pass_shell.c)
 
 ONLY_LANG=""; REFRESH=0; LIST_ONLY=0
 while [ $# -gt 0 ]; do