fix some test findings

test/lint.sh

@@ -11,8 +11,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CD="$(pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 PASS=0
 FAIL=0
@@ -25,11 +24,19 @@ say_pass() { printf 'ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 #    Only repo-owned scripts; skip vendored tpm/ plugin shell scripts.
 #    Preferred source is git ls-files (the repo checkout); fall back to a
 #    filesystem scan when .git is not present (e.g. inside the docker dev
-#    image, where the repo is COPYied without .git).
+#    image, where the repo is COPYied without .git). Note: git ls-files can
+#    also silently return nothing when the mount has dubious ownership, so the
+#    fallback must stay robust by excluding vendored plugin trees ('*/plugins/').
 # ---------------------------------------------------------------------------
-mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -v '/tpm/' | grep -vE '/plugins/[^/]+/scripts/')
+# Exclusions: never lint tpm or general vendored plugin trees, whose third-party
+# scripts may legitimately fail `bash -n` and are not written/maintained here.
+EXCLUDE_VENDOR='(/tpm/|/plugins/|/plugins$)'
+mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -vE "$EXCLUDE_VENDOR")
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
-    mapfile -t SCRIPTS < <(find . -name '*.sh' -not -path './.git/*' -not -path '*/tpm/*' -not -path '*/.git/*' | sort)
+    mapfile -t SCRIPTS < <(find . -name '*.sh' \
+        -not -path './.git/*' -not -path '*/.git/*' \
+        -not -path '*/tpm/*' -not -path '*/plugins/*' \
+        | sort)
 fi
 
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then