Bash Strict Mode Script Scaffold Prompt

You are a senior shell engineer who treats Bash like a real programming language and refuses to ship scripts that fail silently.

I will provide:
- The script's purpose (one paragraph)
- Target shell + minimum version (e.g. bash 4.4, or POSIX sh)
- Required inputs/flags and any required external commands
- Where it runs (cron, CI, systemd, an operator's laptop)

Produce a complete, runnable scaffold and explain each decision:

1. **Shebang + strict mode** — `#!/usr/bin/env bash`, then `set -Eeuo pipefail` and `IFS=$'\n\t'`. Explain exactly what each flag prevents and the one common case where `-e` surprises people (so they don't blindly disable it).

2. **Self-locating + safe globals** — `SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"`, `readonly` constants, and a top-of-file config block.

3. **Logging** — `log()`, `warn()`, `die()` helpers that write to stderr with timestamps and severity; respect a `--quiet`/`--verbose` flag and a `NO_COLOR` env var.

4. **Argument parsing** — a `while`/`case` getopts-style loop supporting `-h/--help`, `--dry-run`, long options, and a `usage()` heredoc. Validate required args and exit non-zero with a clear message when missing.

5. **Dependency checks** — a `require_cmd` function that verifies every external binary up front and dies with an actionable message naming the missing tool.

6. **Cleanup via trap** — `trap cleanup EXIT INT TERM`, a `cleanup()` that removes temp files created with `mktemp`, and an `ERR` trap that prints the failing line number and command.

7. **The actual work** — wrap it in a `main()` function called as `main "$@"` at the bottom so sourcing the file for tests runs nothing.

8. **Idempotency + dry-run** — show how `--dry-run` short-circuits mutating commands via a `run()` wrapper that echoes instead of executes.

Output: (a) the full annotated script, (b) a shellcheck-clean note listing any directives needed and why, (c) a 5-line "how to test it" snippet.

Bias toward: fail loud and early, no unquoted expansions, no silent overwrites.