Bootstrap resolves the billing account, with orchestration in scripts

## Summary

Move the sequencing in `just bootstrap` and `just alunduil` into
`scripts/bootstrap.sh` and `scripts/alunduil.sh`, leaving one-line recipes.
That gives the bootstrap flow a single shell scope, which is what lets it
resolve `TF_VAR_billing_account_id` from `gcloud` instead of asking for it on
every run.

## Motivation

`TF_VAR_billing_account_id` is a required Terraform variable with no default, so
`docs/how-to/bootstrap.md` asks for it on every run. It doesn't need to be: the
account is discoverable with `gcloud billing accounts list --filter=open=true`,
which `dungeon-studio-infrastructure` already does in `resolve_billing_account`
— auto-selecting when there's one open account and offering a `select` menu when
there are several.

That helper can't land as-is here. Each line of a plain `just` recipe runs in its
own shell, so an `export` on one line doesn't reach `terraform apply` on the
next. The fix isn't to work around it per-variable; it's the recipe shape.
`dungeon-studio-infrastructure` has no such problem because its justfile is
one-line recipes with all sequencing in scripts.

Two things fall out of the same change:

- The 15-line shebang body of `just alunduil` has never been linted. `identify`
tags `justfile` as plain text, so the shellcheck and shfmt hooks skip it —
confirmed with `pre-commit run shellcheck --files justfile`, which reports "no
files to check". Five secret fetches and a `GITHUB_TOKEN` assignment sit
outside every sensor the repo runs.
- `resolve_billing_account`'s branches (no open account, exactly one, several)
are pure logic around a stubbable `gcloud` call, so they get a bats suite —
which a justfile recipe can't have.

Raised while reviewing #461, which needed the same shell-scope property and
worked around it rather than fixing the shape.

## Scope

- Add `scripts/bootstrap.sh` as a thin orchestrator: resolve the billing
account, then call `bootstrap-terraform-state.sh`, the two `terraform`
commands, `configure-git-sync-secrets.sh`, and `configure-github-secrets.sh`.
It calls those three rather than absorbing them — they're focused and two
already carry bats suites.
- Add `scripts/alunduil.sh`, lifting the break-glass apply out of the shebang
recipe.
- Reduce `bootstrap` and `alunduil` to one-line recipes; keep the phase names
visible in each script's `main()`.
- Port `resolve_billing_account`, with a bats suite over its three branches.
- Drop `export TF_VAR_billing_account_id` from `docs/how-to/bootstrap.md`.
- Point `just test` at `bats --recursive github/projects scripts`, matching what
`.github/workflows/bats.yml` already runs. Today it runs only
`github/projects/*.bats`, so the shell-helper tests its own `[doc]` string
advertises never run locally.

## Acceptance criteria

- [ ] `just bootstrap` runs with no `TF_VAR_billing_account_id` in the
environment, on an account with one open billing account
- [ ] Several open billing accounts produce a `select` menu; none produces a
clear error
- [ ] An explicit `TF_VAR_billing_account_id` still wins over discovery
- [ ] `pre-commit run shellcheck --all-files` covers the bash that was in
`just alunduil`
- [ ] `just test` and `.github/workflows/bats.yml` run the same suites
- [ ] `docs/how-to/bootstrap.md` no longer lists the billing account as an export

## Additional context

Leaves one duplication in place rather than fixing it: `just alunduil` and
`scripts/export-terraform-credentials.sh` both enumerate the same five
`(TF_VAR, secret)` pairs, because the local path exports into its own
environment and the CI path writes `GITHUB_ENV`. Once both are shell, a shared
table becomes possible — worth its own issue rather than riding this one.

Depends on #461, which adds two of those pairs and the
`configure-git-sync-secrets.sh` step this orchestrator would call.