%% - do you handle here docs as well and ignore embedded multiline strings containing perl or awk, for all styles of ', ", \-escaped or HERE-document?

Identifying bash scripts:

If the script's not being invoked by sourcing or an explicit bash filename: -T file AND -x file AND strings [\s/](ba)?sh or sh<versionstring> in the shebang line AND (to be safe) some specific bourne-shell style idiom like N>&N.

Also consider asking file(1) for a guess.

Definitely a lie, but still quite common:

#!/bin/sh
#!perl # -w -Sx: line count is one off
eval 'exec perl -Sx $0 ${1:+"$@"}'
   if 0;
[download]

Trying to distinguish between bourne-descending shell might be an additional challenge. Bash vs ksh93 vs dash vs pdksh vs zsh vs csh-considered-harmful vs ... .

Homework for the astute reader: which of the above shells would be the most easy to detect and exclude?