test(release): close scanner guard coverage gaps

[LunaMeerkats]

Summary

The release guard currently stays green when the Slack pattern disappears or the tracked-file list is empty. This adds provider-labelled synthetic cases, checks both directions of pattern/case coverage, requires each provider's own diagnostic, and verifies that exact allowlist entries are reachable. It also checks Git's enumeration status and scanner sentinel, preserves NUL-delimited paths, and captures dirty-tree diagnostics before displaying ten lines so the guard exits 1 instead of SIGPIPE.

The scanner change removes only the unreachable AWS secret-example exemption and explains why. Detection patterns and the staged-enumeration/blob-read handling from #410 remain unchanged, as do the existing no-echo and staged-path regressions. No Rust, public API, release figure, workflow or #346 wiring changes.

Related Issue

Closes #387. Continues the scoped invitation in #387 (comment) and the disclosed claim in #387 (comment).

Validation

Validated on Ubuntu/WSL against 61b3a878e96ececf19125ec5af15f665d33853b9:

• Updated regression guard; all ten isolated fixture contracts passed: a clean case and nine fault cases. Pristine upstream falsely accepted seven faults; the Groq-deletion calibration already failed correctly, and fifteen synthetic dirty files exited 141. The updated guard rejects every fault with exit 1 and its intended diagnostic.
• bash tests/release/no-secrets.test.sh passed on the complete tracked tree, including the unchanged staged/no-echo cases.
• bash -n scripts/check_no_secrets.sh tests/release/no-secrets.test.sh, ShellCheck 0.11.0 --severity=warning on both changed files, python3 scripts/check_evidence_claims.py ., and git diff --check passed. The local CI runner's repository-wide ShellCheck also passed.
• Security impact considered; generated filler only. Production patterns and the daemon trust boundary are unchanged. Supporting comments explain the removed exemption.
• Full CI passes. bash scripts/ci-local.sh --no-postgres completed with 28 passing steps, four failures, five unavailable-tool warnings and one deliberate Postgres skip. Direct execution of all 22 release scripts gave 20 passes and two failures.

The two release failures also reproduce on the clean pinned upstream: release-rehearsal.test.sh:33 executes an unquoted path containing spaces (exit 127), and docs-share-cards.test.sh encounters the Windows Git checkout's symlink placeholder instead of a PNG. Workspace Clippy and rustdoc cannot build because this WSL installation lacks GLib/GObject/GIO/GDK development packages. No Rust files changed; this uses CONTRIBUTING's no-Rust carveout. Missing cargo-nextest, cargo-audit, markdownlint, markdown-link-check and yamllint remain unvalidated. Hosted Ubuntu CI subsequently completed all four workflows successfully on d2713347f4ad06da301261d7c984e35bf7b9f186 at 2026-09-11T21:39:30.699808Z: ten jobs passed and container-smoke was skipped. The skipped job remains unvalidated, and the local broad-run limitations above still apply.

Notes for Reviewers

Prepared, tested, and reviewed autonomously by OpenAI Codex through LunaMeerkats. The complete two-file diff received a separate automated review; human review is not claimed.

The table reader deliberately follows the scanner's existing quoted-array format. The coverage check catches a pattern or case changed independently; coordinated removal of both remains outside its claim. The local mutation harness uses temporary Git repositories and synthetic filler; it is validation evidence rather than an added repository framework. The initial added-provider fixture accidentally matched its own literal; it was corrected and the complete baseline comparison rerun before drawing the results above.