Correct Four Code Style Rules and State That No Shell Header Comment Is Required - #4141

Summary

Corrects four code style rules that fail when followed (#4015), and states plainly that the shell code style requires no header comment (#3668).

• SA1201 member order. dotnet-codestyle references/conventions.md sorted members by access first. It now orders by kind across every access level (SA1201), then by access within one kind (SA1202), then const, static, and readonly (SA1203, SA1204, SA1214). The kind list now follows StyleCop's published SA1201 order, which places conversion operators and operators before methods. The SKILL.md summary line says the same.
• PowerShell unknown arguments. CODESTYLE.md "Command-Line Arguments" now says the binder refuses an unknown parameter only in a script carrying [CmdletBinding()]. A plain param() block binds it into $args and runs on, so such a script refuses a non-empty $args itself before any work. python-codestyle and shell-codestyle carry the section as a generated include.
• POSIX shell exception. shell-codestyle now carries the GOVERNANCE.md exception: a deliberately POSIX #!/bin/sh script takes set -eu.
• Local loop venv. Both pip-form uv pip install lines in python-codestyle now pass --python .venv/bin/python, since uv pip install targets an active VIRTUAL_ENV ahead of ./.venv. The catalog/snippets/configs/vscode-tasks-python.json comments describing the same installs say the same.
• Shell header comment. shell-codestyle now says no header comment is required, so the set line may follow the shebang. A comment above it carries a specific non-obvious point, and the no-summary rule in comment-and-doc-style still forbids one restating the script. The description calls set -Eeuo pipefail a line rather than a header.

Generated copies under .github/skills/ and .claude-plugin/ regenerated with scripts/build_dist.py, and --check is clean.

The snippet change edits two JSONC comment lines, so this pull request carries the comments label.

Local review findings

• GOVERNANCE.md "Workflow YAML Conventions", the "Shells" bullet's POSIX exception reason (pre-existing, canonical unit). It says sh carries neither -E nor pipefail, which is broader than true. This branch states the narrower dash reason in shell-codestyle. Gathered onto the unit's tracker, Tracker: GOVERNANCE.md > Workflow YAML Conventions #4140.
• catalog/snippets/husky/pre-commit, set -eu follows the _/husky.sh source line (pre-existing, declined). The reviewer's stated failure is a command failing inside the sourced _/husky.sh going unnoticed. That file is a trusted runtime the hook installer generates. Per GOVERNANCE.md "Trust Boundaries and Hardening Effort", a silent failure inside it is not a realistic case in the hook's deployment, so it earns neither a fix nor an issue. Moving set -eu above the source line would also put the generated file's own exit status under -e, which this branch has no evidence is safe.

Closes on promotion: #4015, #3668

🤖 Generated with Claude Code