PR #430 follow-ups: nested-source export gap, binary-unsafe copy snippet, shell-tier conflict nf-nc7y ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/432 by tools/beads/import_github.py's reconcile pass.

Suggestions from ninefold-reviewer's review of #430. Advisory — the PR was CONVERGED, none of this blocked it.

1. Nested .aseprite sources are silently never exported

art_dump/README.md step 1 says *"Save the .aseprite anywhere in this folder"*, but the export glob in art_dump/sync.sh is top-level only:

```sh sources=("$DUMP"/*.aseprite "$DUMP"/*.ase) ```

A sprite saved to art_dump/chars/hero.aseprite never enters the loop, so it never gets a .png/.json and the "Aseprite was not found" warning never fires for it — the failure is silent either way. Fix by widening the source list (find "$DUMP" \( -name '*.aseprite' -o -name '*.ase' \)) or by tightening the README to "at the top level of this folder". Organising sprites into subfolders is the obvious thing to do once there are more than a handful.

2. The documented copy command is binary-unsafe outside bash

art_dump/README.md and the new CLAUDE.md section both give:

```bash git show origin/art-dump:char2.png > games/explore/assets/char2.png ```

Two wrinkles for the sandbox box, whose declared primary shell is PowerShell:

• In PowerShell, > is Out-File — it re-encodes the stream as text and corrupts the PNG. No error; it surfaces later as a bad Godot import.
• games/explore/assets/ does not exist yet, so the redirect fails on first use even in bash.

Either mark the snippet "run this in bash" plus a mkdir -p, or give a shell-agnostic form (git checkout origin/art-dump -- char2.png, then move it into place).

3. sync.sh vs. the in-flight "no logic in shell" design (#429)

art_dump/sync.sh is 120 lines with an export loop, temp-index plumbing and fetch/push branching — squarely the shape [design_docs/001-no-logic-in-shell.md](https://github.com/cfsh/ninefold/pull/429) targets (Google's 100-line / non-straightforward-control-flow threshold). The two PRs were open at the same time. Worth an explicit call: grandfathered, or the first script the new rule applies to?

4. Smaller notes

• ASEPRITE=/path/to/Aseprite.exe is the documented escape hatch in sync.sh's warning text but appears nowhere in art_dump/README.md.
• art_dump/sync.cmd hardcodes %ProgramFiles%\Git\bin\bash.exe. A per-user Git for Windows install lives under %LOCALAPPDATA%\Programs\Git and would fail with only cmd's own "file not found". A where bash fallback would cover it.
• GIT_INDEX_FILE="$idx" git -c core.safecrlf=false add -f -- "$DUMP" snapshots every file in the folder bar the four NOT_ART entries, then pushes it to GitHub unattended. That is the design ("no button clicking"), but an extension allowlist (.aseprite .ase .png .json) would stop a stray reference image or scratch file riding along unnoticed.