Wrap astable jobs in bash heredoc — alpine's default sh is ash

Alpine 3.20 ships busybox ash as /bin/sh, which doesn't parse
bash arrays (ARGS=(...) syntax). GitLab CI runs script: blocks
with sh -c by default, so we couldn't use the bash array even
though we apk-add bash. Wrap the whole block in bash -s <<'EOF'
… EOF so bash actually evaluates it.

kibot-ci.yml

@@ -366,15 +366,18 @@ astable_dev:
       artifacts: true
     - job: generate_3d
       artifacts: true
+  # Script body wrapped in `bash -s` because alpine ships busybox ash
+  # by default, which doesn't parse bash arrays (ARGS=(...)). The
+  # quoted heredoc keeps GitLab from substituting variables — bash
+  # sees the raw $CI_PROJECT_DIR etc. and expands them itself.
   script:
     - |
+      bash -s <<'BASH_SCRIPT'
+      set -euo pipefail
       FAB="$CI_PROJECT_DIR/Fabrication"
       SUB="$FAB/${PROJECT_NAME}"
       VAL="$CI_PROJECT_DIR/Validation"
 
-      # Build args list — each --flag is optional; the script skips
-      # files that aren't present. Dev runs have fewer outputs than
-      # main (no gerbers/panel), so we just pass what exists.
       ARGS=(
         --file "$FAB/${PROJECT_NAME}_dev_bom.csv"
         --part-ipn "$PROJECT_NAME"
@@ -393,6 +396,7 @@ astable_dev:
       [ -f "$VAL/${PROJECT_NAME}-drc.html" ]               && ARGS+=(--drc-report     "$VAL/${PROJECT_NAME}-drc.html")
 
       upload-bom.sh "${ARGS[@]}"
+      BASH_SCRIPT
 
 astable_main:
   extends: .astable_base
@@ -419,17 +423,15 @@ astable_main:
     paths:
       - Fabrication/
     expire_in: 1 week
+  # Same alpine + ash limitation as astable_dev — invoke bash.
   script:
     - |
+      bash -s <<'BASH_SCRIPT'
+      set -euo pipefail
       FAB="$CI_PROJECT_DIR/Fabrication"
       SUB="$FAB/${PROJECT_NAME}"
       VAL="$CI_PROJECT_DIR/Validation"
 
-      # MR-to-main → upload to the dev rev (pre-ordering window).
-      # Actual main pushes → released rev named from the commit
-      # message. The BOM CSV's filename always uses ${VERSION} —
-      # extract_version sets it to "dev" for MRs and the V-token
-      # for direct pushes, so we can read the same path either way.
       if [[ "$CI_PIPELINE_SOURCE" == "merge_request_event" ]]; then
         BRANCH=dev
       else
@@ -457,6 +459,7 @@ astable_main:
       [ -f "$VAL/${PROJECT_NAME}-drc.html" ]                      && ARGS+=(--drc-report     "$VAL/${PROJECT_NAME}-drc.html")
 
       upload-bom.sh "${ARGS[@]}"
+      BASH_SCRIPT
 
 # =============================================================================
 # Stage: Release