Fix src/shuriken.sh lib source list missing 5 modules

Running `bash src/shuriken.sh --generate ...` directly from a source
checkout printed "command not found" for camera_label_from_make_model,
photo_exif_values_to and cached_photo_identify_output for every photo,
silently emptying EXIF tooltips/details and, with STATS_PAGE=yes,
omitting the whole stats/ tree. The hand-maintained source list inside
the SHURIKEN_LIB_SOURCES_BEGIN/END marker block had drifted from the
authoritative Justfile LIB_SOURCES, missing metadata-label,
metadata-cache, stats-aggregate, stats-render and stats-filter-album.
`just build` replaces the marker block with LIB_SOURCES when generating
bin/shuriken, so the installed binary and the bin-based test suite never
noticed; only direct src execution was affected.

- Add the 5 missing `source` lines to the marker block in the same order
  as Justfile LIB_SOURCES, so the two lists now match exactly.
- Add tests/cli.sh case test_lib_sources_match_justfile_lib_sources that
  extracts the marker-block module names and asserts they equal the
  Justfile LIB_SOURCES (same set and order) to prevent future drift.
- shellcheck --check-sourced now follows the 5 newly-sourced libs;
  suppress the cross-module nameref false positives (SC2178/SC2128/
  SC2154) with explained directives and genuinely fix SC2004
  (counts_ref[$key] -> [key]) and quote the TITLE default (${TITLE:-}).

bin/shuriken changes only by these propagated lib edits; the marker-block
source list it generates is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 28 insertions, 4 deletions

diff --git a/bin/shuriken b/bin/shuriken
index b5d8839..cc8cac2 100755
--- a/bin/shuriken
+++ b/bin/shuriken
@@ -1290,7 +1290,11 @@ prepare_template_render_var__config_html() {
             context_value="${THUMBHEIGHT:-}"
             ;;
         TITLE)
-            context_value="$TITLE"
+            # Always defaulted by apply_config_defaults; degrade to empty if
+            # somehow unset, matching the other config cases above. The :-
+            # default also silences SC2153 (a lowercase "title" local in another
+            # --check-sourced module makes shellcheck suspect a misspelling).
+            context_value="${TITLE:-}"
             ;;
         *)
             config_error "unknown template render config $source_name"
@@ -2190,7 +2194,10 @@ photo_exif_values_to() {
             # shellcheck disable=SC2034
             output_ref["${BASH_REMATCH[1]}"]="${BASH_REMATCH[2]}"
         elif [[ "$line" =~ ^[[:space:]]*Geometry:[[:space:]]*(.*)$ ]]; then
-            # shellcheck disable=SC2034
+            # __geometry is a literal array key, not a variable; --check-sourced
+            # nameref aliasing across modules misreads it (SC2154). SC2034 covers
+            # the caller-owned array write.
+            # shellcheck disable=SC2034,SC2154
             output_ref[__geometry]="${BASH_REMATCH[1]}"
         fi
     done
@@ -2336,15 +2343,22 @@ photo_exif_details_html() {
     printf '</table>\n'
 }
 
+# output_ref is a string nameref here. Other modules (e.g.
+# metadata-cache.source.sh) reuse the name "output_ref" as an associative array,
+# so --check-sourced cross-file nameref aliasing misreports each string write as
+# an array assignment (SC2178). Both writes below are correct string nameref
+# assignments, so SC2178 is suppressed at each one.
 _first_exif_value_to() {
+    # shellcheck disable=SC2178
     local -n output_ref="$1"; shift
     local -n exif_ref="$1"; shift
     local key
 
+    # shellcheck disable=SC2178
     output_ref=''
     for key in "$@"; do
         if [ -n "${exif_ref[$key]:-}" ]; then
-            # shellcheck disable=SC2034
+            # shellcheck disable=SC2034,SC2178
             output_ref="${exif_ref[$key]}"
             return
         fi
@@ -4725,7 +4739,7 @@ _stats_max_count() {
     local -i max=0
 
     for key in "${!counts_ref[@]}"; do
-        if (( counts_ref[$key] > max )); then
+        if (( counts_ref[key] > max )); then
             max=${counts_ref[$key]}
         fi
     done
@@ -5034,10 +5048,15 @@ _stats_random_background() {
 # namespace is unchanged so selection is identical to the former inline code.
 _stats_pick_background() {
     local -r context="$1"; shift
+    # photos is a newline-joined string of photo paths, not an array. Other
+    # modules reuse the name "photos" as an array, so --check-sourced nameref
+    # aliasing misreports SC2178/SC2128; both are false positives here.
+    # shellcheck disable=SC2178
     local -r photos="$1"; shift
     local -a list=()
     local photo
 
+    # shellcheck disable=SC2128
     while IFS= read -r photo; do
         [ -n "$photo" ] && list+=("$photo")
     done <<< "$photos"
@@ -5126,11 +5145,16 @@ declare -gr STATS_FILTER_BACKHREF='../..'
 # <div class="thumbs-grid"> container the main pages use.
 _stats_build_filter_thumbs() {
     local -r backhref_html="$1"; shift
+    # photos is a newline-joined string of photo paths, not an array. Other
+    # modules reuse the name "photos" as an array, so --check-sourced nameref
+    # aliasing misreports SC2178/SC2128; both are false positives here.
+    # shellcheck disable=SC2178
     local -r photos="$1"; shift
     local -a photo_list=()
     local photo
     local thumbs=''
 
+    # shellcheck disable=SC2128
     while IFS= read -r photo; do
         [ -n "$photo" ] && photo_list+=("$photo")
     done <<< "$photos"