Add script/gh_auth_check to verify gh CLI installation and auth

[kitcommerce]

Fixes #926

Adds script/gh_auth_check, a shell script that:

• Verifies gh CLI is installed (exits non-zero with install instructions if not)
• Runs gh auth status and exits non-zero with login guidance if not authenticated
• Prints a success message when both checks pass

Client impact

None (developer tooling only).

Verification Plan

./script/gh_auth_check

[kitcommerce]

Architecture Review

Verdict: NEEDS_REVISION

Finding (severity: medium): This PR ships a second script/pr_body_check — a 133-line POSIX sh version — that directly conflicts with the 46-line bash version introduced in PR #1120. If both are merged, the repository will have one canonical script with two incompatible histories depending on merge order, or a merge conflict that gets resolved in an ad hoc way.

The right approach is one of:

1. Supersede — Mark PR Add script/pr_body_check to validate PR body sections #1120 as superseded by this one; this PR's pr_body_check becomes the canonical version.
2. Compose — Have pr_body_check call gh_auth_check as a preflight (sourced or subprocess) rather than re-implementing auth checks inline.
3. Defer URL parsing — Keep PR Add script/pr_body_check to validate PR body sections #1120's simple version canonical, and defer URL parsing + auth preflight to a follow-on PR that explicitly replaces it.

gh_auth_check as a standalone script is well-scoped and has no overlap concern — that part is clean.

Action required: Coordinate with PR #1120 and choose one of the above approaches before merge.

[kitcommerce]

Simplicity Review

Verdict: NEEDS_REVISION

The 133-line pr_body_check re-implements gh auth checking logic that also lives in gh_auth_check. This duplication violates the single-responsibility principle and increases maintenance surface.

Specifically: the auth preflight block inside pr_body_check should be a call to gh_auth_check (or a sourced helper) rather than copied logic. If gh_auth_check's error messages or behavior change, pr_body_check won't stay in sync.\n\ngh_auth_check itself (31 lines) is appropriately lean — no simplicity concerns there.

[kitcommerce]

Security Review

Verdict: PASS

gh_auth_check: command -v gh and gh auth status are safe. No user input interpolated. Exit messages are hardcoded strings. Clean.

pr_body_check (133-line version): URL parsing uses shell parameter expansion and sed on the input argument — no eval, no unsafe substitution patterns observed. The --repo flag is passed as a positional argument to gh, not interpolated into a command string. PR body content is piped through grep, not executed. Auth preflight runs before any gh calls.

No significant security concerns in either script.

[kitcommerce]

Rails Conventions Review

Verdict: PASS (N/A)

Shell scripts only — no Ruby code. Rails conventions do not apply. Confirmed.