formatters/sh: SETE-2 must scan the whole file, not line by line

SETE-2 matched `sh -c "..."` with a per-line regex requiring both quotes on one
line. The shape that motivated the check spans lines:

    sh -c "
        hugo mod get ...
        hugo mod tidy
    "

so the real sync-deps bug — the one this check exists for — was never flagged.
Verified against the actual pre-fix sync-deps: now reports at line 358,
"4 commands and no 'set -e' inside".

Scans the file text with re.DOTALL and reports the line of the match start.
Falls back to counting non-blank lines when the body is newline- rather than
;-separated, which is what the multi-line form looks like.

Adds both regression cases (multi-line without set -e must flag; multi-line
with set -e must not). Verified they go red when the whole-file scan is
disabled. Neither of the two fixed real scripts is flagged.

Note for whoever extends this suite: fixtures written with a heredoc inside it
did not behave; the printf form does. Both new tests use printf.

Claude-Session: https://claude.ai/code/session_014KNyfHmHpMbdMrHZXDRkAp

formatters/sh

@@ -89,15 +89,6 @@ def count_top_level_commands(s):
     return separators + 1
 
 for i, line in enumerate(lines, 1):
-    # SETE-2: sh/bash -c with 2+ ;- or newline-separated commands and no set -e inside
-    m = re.search(r'\b(?:sh|bash)\s+-c\s+(["\'])([^"\']*)\1', line)
-    if m:
-        s = m.group(2)
-        if not re.search(r'(^|[^A-Za-z0-9_])set\s+-[A-Za-z]*[eE]', s):
-            n = count_top_level_commands(s)
-            if n >= 2:
-                findings.append((i, "SETE-2 sh/bash -c with " + str(n) + " ;-separated commands and no 'set -e' inside; container exit reflects only the last command"))
-
     # LEAK-1: command substitution reading a secret-named file, inside echo/printf/die/error/fail
     sink_match = SINK_RE.search(line)
     if sink_match:
@@ -107,6 +98,24 @@ for i, line in enumerate(lines, 1):
             if SECRET_RE.search(var):
                 findings.append((i, "LEAK-1 secret variable '$" + var + "' read into string passed to '" + cmd + "'; could print credential document"))
 
+# SETE-2 runs over the WHOLE source, not line by line: the shape that motivated
+# this check spans lines —
+#     sh -c "
+#         hugo mod get ...
+#         hugo mod tidy
+#     "
+# — so a per-line regex requiring both quotes on one line never matched it.
+for m in re.finditer(r'\b(?:sh|bash)\s+-c\s+(["\'])(.*?)\1', content, re.DOTALL):
+    body = m.group(2)
+    if re.search(r'(^|[^A-Za-z0-9_])set\s+-[A-Za-z]*[eE]', body):
+        continue
+    n = count_top_level_commands(body)
+    if n < 2:
+        n = len([ln for ln in body.splitlines() if ln.strip() and not ln.strip().startswith('#')])
+    if n >= 2:
+        line_no = content[:m.start()].count('\n') + 1
+        findings.append((line_no, "SETE-2 sh/bash -c with " + str(n) + " commands and no 'set -e' inside; exit status reflects only the last command"))
+
 for line_no, msg in findings:
     print(filepath + ":" + str(line_no) + ": " + msg)