You guys are spot on about the .dmg. I even knew this, and already
extracted the .pkg... and then uploaded the wrong file. It's been one of
those months.
I created a policy to push out the .pkg, and while it reports as
successfully installed in JSS, it has no effect on the bash version
reported compared to a base 10.9.5 install, nor does it pass a
vulnerability test via script (even after restarting, ...
