ci: keep the stray-literal guard to bash 3.2 and to a durable citation

[rubentalstra]

What changed and why

scripts/checks/stray-literals.sh expanded its file list unguarded, which bash 3.2 under set -u reads as unbound when the list is empty. Its header also cited an internal rule file. FerroFED's bash-compat and comment-style guards caught both in that console's copy. The fix keeps the four consoles' copies identical to this one: ${files[@]+"${files[@]}"}, and the header now says no specification governs the guard. No console sees a behaviour change.

Licensing of contributions

• I accept the terms in CONTRIBUTING.md § Licensing of contributions: I have the right to submit this work, I license it under the project licence of the version it lands in, and I grant the Licensor the relicensing right stated there.

Checklist

• Accessibility decisions cite WCAG 2.2, WAI-ARIA 1.2 or the Authoring Practices, not memory and not another library.
• Rust gates pass: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, the wasm32 clippy runs, cargo nextest run --workspace --locked, cargo doc with RUSTDOCFLAGS=-D warnings, and cargo deny check.
• A visible change refreshed the gallery screenshots, and I looked at every image it changed.
• A new or changed component was compared with the four consoles' versions (docs/qa/), and the best one on its merits was restyled to the library's tokens; the winner and the reason are stated below.
• Its interactive states (pointer, focus, open, each tone) are captured by tests/it/states.rs in every brand, light and dark.
• A release pull request says, per screen and per state, what was checked and what was fixed.
• Shell and workflow files are clean: shellcheck --severity=style, actionlint, zizmor --min-severity=low .github/.
• CHANGELOG.md has an [Unreleased] entry, if a console sees the change.
• No patient data in a fixture, test, gallery row or example.
• Every commit is signed.
• No AI or assistant attribution anywhere in the commits or this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud