📋 PLAN: Bash Upgrade & Shebang Standardization

Option 1: Compile from source — download bash-5.3.tar.gz, ./configure && make && make install to /usr/local/bin/bash. Gives us 5.3 immediately.

Option 2: Wait for distro package — Ubuntu Noble ships 5.2.21. Bash 5.3 will land in a future Ubuntu release or PPA. Easier, but we stay on 5.2 for now.

Option 3: Use a PPA or backport — check if someone maintains a bash PPA for Ubuntu. Unknown reliability.

⚠️ Note: 5.2.21 is not ancient. The jump to 5.3 gives us associative array improvements, some new builtins, and bug fixes, but nothing critical. This is a "latest is best" decision, not a "we're broken" decision.

If we compile from source, it installs to /usr/local/bin/bash by default. With #!/usr/bin/env bash, the env lookup will find /usr/local/bin/bash first (because /usr/local/bin is typically earlier in $PATH). So the shebang change + source install work together naturally.

We do NOT replace /usr/bin/bash — that belongs to the package manager.

Step 1: Audit all machines.
SSH to each VM, run bash --version, report back a table of what everyone has.
Deliverable: table. No changes.

Step 2: On ONE machine (Walter), compile Bash 5.3 from source.

cd /tmp
curl -O https://ftp.gnu.org/gnu/bash/bash-5.3.tar.gz
tar xf bash-5.3.tar.gz
cd bash-5.3
./configure --prefix=/usr/local
make
sudo make install

Verify: /usr/local/bin/bash --version → 5.3.0
Deliverable: version output. Then STOP.

Step 3: Update shebangs on Walter.
Change #!/bin/bash → #!/usr/bin/env bash in all our scripts (snapshot-all.sh, vault-snapshot.sh, etc.)
Deliverable: diff of changes. Then STOP.

Step 4: If Walter works fine, repeat Steps 2–3 on each machine, one at a time.
Order: Walter Jr → Amy → Vault → rest.
Each machine: compile, verify, update shebangs, report, STOP.