fix(ci): pin shell: bash on the test gate

Addresses the PR #25 review: the step uses `shopt`, a bash builtin, but relied
on the runner default rather than declaring the shell. True today on
ubuntu-latest; pwsh on a Windows runner, where the step would break if the job
were ever copied.

Worth noting the fix is not purely defensive — `shell: bash` is not the same as
the default. It runs `bash --noprofile --norc -eo pipefail` rather than
`bash -e`, so the gate also stops inheriting profile files and gains pipefail.
Both are improvements here, and neither changes this step's behaviour (it has no
pipes). Updated the inline comment that credited "the Actions default" for the
abort, since `-e` now comes from the pinned shell.

Re-verified under the exact flags `shell: bash` invokes
(`bash --noprofile --norc -eo pipefail`):
  - real run: 14 test files pass, exit 0
  - zero-match glob: exit 1 with the ::error:: annotation
  - a deliberately failing suite: aborts, exit 1
  - release.yml parses; test/build/draft-release intact; shell resolves to bash

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ndemianc

.github/workflows/release.yml

@@ -29,6 +29,11 @@ jobs:
         with:
           node-version: "24"
       - name: Extension unit tests
+        # `shopt` is a bash builtin, so pin the shell instead of relying on the runner default (bash on
+        # Linux/macOS, but pwsh on Windows — where this step would break if the job were ever copied).
+        # Explicit `shell: bash` also upgrades the default `bash -e` to
+        # `bash --noprofile --norc -eo pipefail`, so a stray profile file can't perturb the gate either.
+        shell: bash
         # DISCOVERS suites — it used to `cd extensions/levelcode-ai`, so levelcode-updater's tests never
         # ran here, including the one guarding the updater's Download button against serving a raw
         # .app.zip. Globbing every extension means a new suite is gated the moment it is added, with no
@@ -38,7 +43,7 @@ jobs:
           count=0
           for t in extensions/*/test/*.test.js; do
             echo "── $t"
-            node "$t"          # `bash -e` (the Actions default) aborts the job on the first failure
+            node "$t"          # `-e` (from `shell: bash` above) aborts the job on the first failure
             count=$((count + 1))
           done
           # A zero-match glob would otherwise report success and gate nothing — the exact failure this