ci: complete release compatibility and quality gates (#234)

[codeforester]

Summary

Completes the remaining #234 release-gate work after #277:

• adds pinned Bash 4.4.23, 5.0.18, and 5.2.37 networkless compatibility jobs;
• adds a read-only, networkless Quality workflow with warning ShellCheck,
  changed-source shfmt, and actionlint gates;
• adds deterministic parallel import/temporary-directory cleanup coverage;
• adds a CI/default-branch policy with required checks, review, and auditable
  emergency procedures;
• documents the hosted Bash/macOS/Linux matrix and the explicitly advisory BSD
  position; and
• keeps the public libraries as single-file boundaries.

Validation

• ./tests/validate.sh (546 BATS tests plus property, artifact, benchmark,
  concurrency, support, release, docs, integration, and example stages)
• ./tests/lint-warnings.sh
• exact shfmt 3.8.0 on every touched Bash source
• actionlint v1.7.7 on all workflows
• git diff --check

The shfmt workflow checks every Bash source changed by a pull request (or the
latest commit on main) so legacy formatting debt is not silently expanded.

Fixes #234