Expand description
executable_has_shebang — every +x file in scope must
begin with a shebang line (#!).
Catches the common bug where a script has been marked executable but its content is something else (a text file, a binary missing the shebang). Running such a file silently invokes the user’s login shell — surprising at best, exploit vector at worst.
Non-Unix platforms: rule is a no-op (no real +x semantics). No fix op — the correct resolution (add shebang vs. remove +x) is a human judgment call.