fix: round 6 of the release review of 6.3.0

Round 6 (v6.2.0..c3641ff, WARN: 11 MAJOR, 3 MINOR; 0 BLOCKER). The round-5
fixes hold (code-correctness-reviewer); three of the new MAJOR were side
effects of running checks with no shell. Each fixed behind a test that
failed first on c3641ff.

- git checks stay in the repo too: no path that climbs out with .., starts
  at / or reads <rev>:../x, and no --no-index (both reviewers).
- A trailing `# comment` on a shell-fence line is dropped: with no shell,
  its words made an honest check NOT RUN, among them the first check of the
  shipped example plan.
- A glob reaches `node --test` only on Node 21 and later, which expands it
  itself; on an older Node it is refused with that reason (engines >=18).
- With no shell, exit 126/127 is the test program's own: red proof reads it
  as a red (the control run still tells an environment fault apart), the
  done line and the test lock as a failure.
- A runner that could not start (not installed) is NOT RUN in the criteria
  runner and not-run (exit 2) in regression-check, as red-proof and
  done-line already said; never a red suite.
- Tests-only: a backticked `Makefile` alone in its entry is a path, and red
  proof confirms the plan's tests-only reading against the step's own diff
  (the altitude finding: the diff is a fact, the Files: prose is not).
- release-check stops a suite that never ends (15 minutes) and reads it as
  not measured (exit 2).
- The two lines this release added to pre-bash-executor.mjs are ASCII.
- MINOR: git and the other runners share one plain-word pattern.

Not in this round: MINOR f00a2eb8 (shared norm/ticked-path and isMain
helpers) and MINOR on plan-review-dedup's repeated tokenizing.

Suite 2194 (2192/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

agents/brief-conformance-reviewer.md

@@ -98,7 +98,7 @@ A criterion whose command was **outside the allowlist** is reported as
 `NOT RUN` too: the runner executes a criterion only when its command is a known
 test runner (`npm test`, `node --test`, `pytest`, `bash tests/<script>.sh`, a
 read-only git subcommand, …) carrying no shell operator. Everything else never
-reaches a shell. Like any `NOT RUN` it is the ABSENCE of a measurement, never
+runs (and what runs, runs with no shell: its words reach the runner as written). Like any `NOT RUN` it is the ABSENCE of a measurement, never
 evidence about the code, and never a finding of its own.
 
 **A `NOT RUN` result is never on its own a finding.** It says nothing about
@@ -111,6 +111,7 @@ column names the reason the runner gave:
 | `placeholder` | the text is a template placeholder (`{exact command}`) |
 | `not-a-command` | the sentence opened by NAMING a flag or a path (`--verbose`, `tests/`) rather than by invoking something. Running it would have produced exit 2 or exit 126 — a number about the sentence, not about the code |
 | `outside the allowlist` | the command is not a known test-runner invocation, or it carries a shell operator. It was never run — say so; do not treat it as a broken criterion |
+| `the program could not start` | the runner is not installed where the review ran. Nothing was measured — say so; do not treat it as a broken criterion |
 
 In every one of those cases, judge the criterion on delivered code alone and
 say in the Evidence column that no measurement exists. Emit `MISSING_TEST`