Establish full Bash, OS, strict-option, and supply-chain release gates

[codeforester]

Parent: #214

Train position: 20 of 26
Phase: P3 — Ecosystem trust and broad adoption

Problem

The repository has excellent tests, but the full suite runs only on current macOS and Ubuntu Bash while exact Bash 4.2 receives a narrow logging smoke. Warning lint and several release, workflow, concurrency, and adversarial guarantees are not required merge gates.

Acceptance criteria

• Publish a support matrix and run the complete applicable suite on exact Bash 4.2, representative 4.x and 5.x releases, current Bash, Linux/glibc, Alpine/musl, and macOS/BSD userland.
• Exercise default and supported strict-option combinations against source-installed, Homebrew-installed, vendored, generated-module, and standalone-bundled artifacts.
• Make warning-level ShellCheck, shfmt, action and workflow lint, API and module-manifest checks, documentation examples, generated-artifact drift, and release invariants required.
• Add deterministic property or fuzz coverage for argv, quoting, paths, parser schemas, marker handling, imports, and generated artifacts with reproducible seeds.
• Add focused concurrency, signal, process-tree, cleanup, filesystem-race, and bounded startup/import/performance regressions.
• Pin actions, images, and build tools; use least-privilege permissions and networkless or read-only jobs where applicable.
• Require the complete quality workflow and approving review in default-branch protection, with documented emergency procedures that remain auditable.

Dependencies

• Guarantee public APIs under caller-selected Bash options #216
• Guarantee hard timeouts and always-visible dry-run plans #219
• Harden cleanup deletion, trap, and resource-unwinding contracts #221
• Publish a machine-readable API and module manifest #225
• Make single-file libraries maintainable and deterministic to distribute #232
• Ship pinned bundle, vendor, update, and verified release workflows #233

[codeforester]

PR #265 is merged and enforces the current compatibility/release-gate baseline: exact Bash 4.2.53 smoke, current macOS/Linux validation, optional Alpine probe, deterministic bundle/manifest/provenance checks, and pinned-action invariants.

The broader acceptance bar remains open for representative Bash 4.x/5.x coverage, BSD/userland coverage where hosted runners are available, complete strict-option/artifact combinations, warning-level workflow/docs/generated-drift gates, and additional adversarial/concurrency/performance evidence.

[codeforester]

PR #277 is merged at 1fa6a2d. It adds the deterministic artifact contract and seeded property contract to the required quality path. The gate now runs all eight caller-option combinations through source, generated, vendored, and standalone layouts; validates a generated project through the launcher process boundary; and runs the new checks in the exact Bash 4.2.53 container. CI is green on Bash 4.2.53, Ubuntu, macOS, release gates, and branch policy. #234 remains open for the hosted representative Bash/BSD matrix, pinned image/tool expansion, concurrency/performance evidence, and default-branch review/approval enforcement.