feat: add alias creation to pos system bank interactive menu

New 'alias' subcommand (+ POS_SUBCMDS row, menu option 6 'Manage
aliases'): create/update/list/remove bash aliases that run
'pos system bank run <name>', written into ~/.bashrc inside a managed
marker block (BASH_RC_FILE seam for tests, atomic tmp+mv rewrite).

- alias_valid_name enforces ^[a-zA-Z][a-zA-Z0-9_-]*$
- same-name create is an idempotent retarget; last alias removal cleans
  the whole block; outer ~/.bashrc aliases preserved byte-identically
- outer-alias collision refused (file untouched), PATH-shadow non-blocking
  warn, 'bank remove' drops aliases pointing at the removed command
- GNU sed '1,0p' edge case (block at line 1) fixed with guarded ranges;
  regex-quote literalization avoided via glob case payload match
- t-bank.sh +49 checks (71 -> 120); docs: POS.md, howto/system.md,
  tests/README.md, AGENT_TODO.md; make gen byte-idempotent
  (also refreshes the pos-communication-telegram-listener filetable
  line count so the previous commit's tree is gen-consistent)

DOC/POS.md

@@ -296,7 +296,7 @@ reported as "N videos require sign-in — skipped" (escape hatch:
 | `pos system health` | `bin/pos-system-health` | Host health dashboard: disk per mount, RAM/swap, failed systemd units, backup age, fail2ban, docker containers. Exits 1 if any check FAILs | Console-only reporter — health itself never sends notifications; forward the output with a wrapper (e.g. the Telegram/Matrix listener map `/status=pos system health`) or schedule it via `pos system schedule` with a `NOTIFY` policy. `HEALTH_BACKUP_MAX_AGE_DAYS` (default 2) and `BACKUP_SERVICE_ROOTS` come from `~/.config/linux_post_install/system.env`; `--help` shows the effective values |
 | `pos system schedule <cmd>` | `bin/pos-system-schedule` | Scheduled jobs — run a command on a timer, notify (or stay silent): `run [name\|all]`, `list`, `config`, `enable [name\|all]`, `disable [name\|all]`, `status`, `migrate`. Each job is a file in `~/.config/linux_post_install/schedule.d/<name>.env` with `INTERVAL` (`5m…59m`, `1h…23h`, `hourly`, `daily`, `weekly`, `OnCalendar=…`), `NOTIFY` policy, optional `MSG`, `RULE` (threshold only), and `COMMAND` = the literal rest of the line (pipes/quotes/`sudo` fine). Policies: `always` (full output every run), `onchange` (send when output differs from the last run; first run always sends), `onerror` (non-zero exit or empty output), `threshold` (first numeric output vs `RULE`, alert on false→true + one recovery — the old event-trigger behavior), `never` (side-effect jobs, no notify) | One systemd **user** timer pair per job (`pos-schedule-<name>.timer` + oneshot `.service`, `Persistent=true`), reconciled on `enable`/`disable`; the legacy single `pos-event-trigger` timer is auto-removed. `migrate` converts a pre-existing `event.env` rule set into `schedule.d/rule-N.env` threshold jobs. `config` is an interactive editor (add/edit/remove/enable/disable, validates interval + threshold); alerts via `lib/notify.sh`; `--dry-run` previews runs/writes/sends; jobs are arbitrary shell commands (chmod 600, same trust model as the Telegram map); starter jobs in `config/schedule.d/` auto-installed no-clobber by postinstall. Bare invocation on a terminal (or the `menu` subcommand) opens an interactive hub over these verbs (list, timer status, run-now, enable, disable, config editor) — a menu run-now asks y/N first and goes through the same `run <name>` path the systemd timers use |
 | `pos system uninstall` | `bin/pos-system-uninstall` | Safe, interactive uninstaller for the pos toolkit — scans and removes binaries, services, shell integration, config, and data in three tiers | Tier 1 (always): binaries in `/usr/local/bin/` (pos, pos-*, libs, ai-providers, entertainment plugins, prebuilt, features), systemd services (disable+remove) including runtime-created `~/.config/systemd/user/pos-*` user units, ScaleTail templates + feature-flag store under `/usr/local/share/linux_post_install/`, shell integration in `~/.bashrc` (PATH, completion, pos-ai-hook source), completion file. Tier 2 (`--config`): `~/.config/linux_post_install/` (.env files, schedule.d/, authorized_keys, rclone.conf). Tier 3 (`--data`): `~/.local/share/linux_post_install/` (ai sessions, logs, captured output). Flags: `--yes` (skip prompts, tier 1 only), `--config` (include tier 2), `--data` (include tier 3). Combine all three for nuclear removal. Git repo is never removed |
-| `pos system bank` | `bin/pos-system-bank` | Persistent command bank for saving and running shell commands — list, add, show, run, edit, remove | Commands stored in `~/.config/linux_post_install/bank.env` (pipe-delimited: `name\|description\|command`, chmod 600, managed by the tool). Parameterized `{param}` templates are substituted at run time. Interactive menu on a TTY with no args. `BANK_FILE` env seam overrides the path |
+| `pos system bank` | `bin/pos-system-bank` | Persistent command bank for saving and running shell commands — list, add, show, run, edit, remove, alias | Commands stored in `~/.config/linux_post_install/bank.env` (pipe-delimited: `name\|description\|command`, chmod 600, managed by the tool). Parameterized `{param}` templates are substituted at run time. Interactive menu on a TTY with no args. `BANK_FILE` env seam overrides the path. `alias` subcommand manages bash aliases in `~/.bashrc` inside a managed `# >>> pos bank aliases …` block (`BASH_RC_FILE` env seam) |
 
 A scheduled job is the recommended way to run the health dashboard on a timer: a `daily` job with `COMMAND=pos system health` and `NOTIFY=always` sends the dashboard output as the alert — no separate systemd unit needed (the old `pos-health.{service,timer}` units are gone; a legacy install may still have them failed/leftover — disable and remove them).
 
@@ -315,7 +315,18 @@ On a TTY with no arguments, `pos system bank` opens an interactive menu (list /
 | `pos system bank show <name>` | Show command details and detected parameters |
 | `pos system bank run <name> [key=val …]` | Run a command (interactive for missing params) |
 | `pos system bank edit <name>` | Edit an existing command |
-| `pos system bank remove <name>` | Remove a command |
+| `pos system bank remove <name>` | Remove a command (also drops aliases pointing at it) |
+| `pos system bank alias <name> [alias_name]` | Add/update a bash alias for a bank command (default alias name = bank name) |
+| `pos system bank alias list` | List bash aliases from `~/.bashrc` |
+| `pos system bank alias remove <alias_name>` | Remove a bash alias |
+
+Aliases are bash aliases written into `~/.bashrc` inside a managed block
+(`# >>> pos bank aliases … <<<`, `bashrc`-path seam: `BASH_RC_FILE`), as
+`alias <alias_name>='pos system bank run <name>'` — retyping the same alias
+name retargets the line; removing the last alias removes the whole block.
+An alias name already defined outside the block is refused, and aliasing a
+command that also exists on `PATH` prints a non-blocking warning (the alias
+will shadow it in interactive shells).
 
 Example with parameters: