Add bats test suite for git-manager and obsidian-vault-kb

Isolated per-test $HOME sandboxing via tests/helpers/common.bash.
Covers both plugins' wrapper scripts, their setup.sh, and
git-manager's two PreToolUse hooks (53 tests). Verified the suite
catches regressions by temporarily reintroducing the recently-fixed
vault_search.sh -g/-- ordering bug and confirming it fails.

tests/obsidian-vault-kb/vault_search.bats

@@ -0,0 +1,66 @@
+#!/usr/bin/env bats
+# Tests for skills/obsidian-vault-kb/scripts/vault_search.sh.
+#
+# The "non-markdown file not matched" test is a direct regression guard for
+# the bug where `-g` glob filters were placed after `--`, so ripgrep treated
+# them as literal positional paths instead of options and the *.md filter
+# silently never applied (confirmed by matching content inside a .pdf).
+
+load '../helpers/common'
+
+setup() {
+  sandbox_home
+  SCRIPT="$REPO_ROOT/skills/obsidian-vault-kb/scripts/vault_search.sh"
+  CONFIG_FILE="$HOME/.agent-skills/obsidian-vault-kb/config.json"
+  VAULT="$BATS_TEST_TMPDIR/vault"
+  make_test_vault "$VAULT"
+  write_vault_config "$CONFIG_FILE" "append" "v=$VAULT"
+}
+
+@test "finds a match inside a markdown note" {
+  run "$SCRIPT" pihole
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"dns-setup.md"* ]]
+}
+
+@test "does not match content that exists only inside a non-markdown file" {
+  run "$SCRIPT" attachment-only-marker
+  [[ "$output" == *"(no matches)"* ]]
+  [[ "$output" != *"attachment.pdf"* ]]
+}
+
+@test "does not match content that exists only inside .obsidian" {
+  run "$SCRIPT" obsidian-internal-marker
+  [[ "$output" == *"(no matches)"* ]]
+}
+
+@test "no spurious ripgrep argument errors on stderr/stdout" {
+  run "$SCRIPT" pihole
+  [[ "$output" != *"No such file or directory"* ]]
+}
+
+@test "a subfolder argument narrows the search root" {
+  run "$SCRIPT" pihole v Notes
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"== Search root: $VAULT/Notes =="* ]]
+  [[ "$output" == *"dns-setup.md"* ]]
+}
+
+@test "a subfolder containing '..' is rejected" {
+  run "$SCRIPT" pihole v ../../etc
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no '..' or absolute paths"* ]]
+}
+
+@test "an absolute-path subfolder is rejected" {
+  run "$SCRIPT" pihole v /etc
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no '..' or absolute paths"* ]]
+}
+
+@test "a subfolder symlink escaping the vault is rejected" {
+  ln -s /etc "$VAULT/Notes/escape-link"
+  run "$SCRIPT" pihole v Notes/escape-link
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"outside the vault"* ]]
+}