Rename 99-android to 20-android and improve CLAUDE.md

99-android was not a credential file — it sets up Android SDK paths
and belongs with other build tools. Also updated CLAUDE.md with
validate-all command, test instructions, and clearer permission rules.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -35,14 +35,21 @@ Use these in all scripts — do not manipulate `PATH` or check permissions manua
 ## Permissions
 
 - Directory `~/.bash.d/` itself: mode `700`
-- Regular scripts: mode `755` (executable is **required** for sourcing)
-- Credential files (`99-*`): mode `700` and must call `require_private "${BASH_SOURCE[0]}"` as the first functional line
+- Regular scripts (`00-*` through `50-*`): mode `755` (executable is **required** for sourcing)
+- Credential files (`99-*` with secrets): mode `700` and must call `require_private "${BASH_SOURCE[0]}"` as the first functional line
+- Non-credential config files (e.g. `20-android`): mode `755` like regular scripts
 
 ## Validation
 
 Validate all shell scripts with shellcheck before committing:
 ```bash
-shellcheck <filename>
+shellcheck <filename>          # single file
+shellcheck [0-9][0-9]-*        # all scripts at once
+```
+
+To test changes, open a new shell or source a single file:
+```bash
+source ~/.bash.d/20-ninja      # reload one file in the current shell
 ```
 
 ## Security