fix: round 6 of the release review of 6.3.0

Round 6 (v6.2.0..c3641ff, WARN: 11 MAJOR, 3 MINOR; 0 BLOCKER). The round-5
fixes hold (code-correctness-reviewer); three of the new MAJOR were side
effects of running checks with no shell. Each fixed behind a test that
failed first on c3641ff.

- git checks stay in the repo too: no path that climbs out with .., starts
  at / or reads <rev>:../x, and no --no-index (both reviewers).
- A trailing `# comment` on a shell-fence line is dropped: with no shell,
  its words made an honest check NOT RUN, among them the first check of the
  shipped example plan.
- A glob reaches `node --test` only on Node 21 and later, which expands it
  itself; on an older Node it is refused with that reason (engines >=18).
- With no shell, exit 126/127 is the test program's own: red proof reads it
  as a red (the control run still tells an environment fault apart), the
  done line and the test lock as a failure.
- A runner that could not start (not installed) is NOT RUN in the criteria
  runner and not-run (exit 2) in regression-check, as red-proof and
  done-line already said; never a red suite.
- Tests-only: a backticked `Makefile` alone in its entry is a path, and red
  proof confirms the plan's tests-only reading against the step's own diff
  (the altitude finding: the diff is a fact, the Files: prose is not).
- release-check stops a suite that never ends (15 minutes) and reads it as
  not measured (exit 2).
- The two lines this release added to pre-bash-executor.mjs are ASCII.
- MINOR: git and the other runners share one plain-word pattern.

Not in this round: MINOR f00a2eb8 (shared norm/ticked-path and isMain
helpers) and MINOR on plan-review-dedup's repeated tokenizing.

Suite 2194 (2192/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/parsers/plan-schema.mjs

@@ -293,7 +293,8 @@ export function onFailureAction(text) {
  *
  * - A field with a backticked path names its backticked spans that pass the
  *   path test (a `.`, `/` or `\`; no URL, option or call like `parse()`),
- *   wherever they sit (`a.mjs`/`b.mjs`, inside a note). Its descriptions are
+ *   wherever they sit (`a.mjs`/`b.mjs`, inside a note), and a backticked name
+ *   with no extension that stands alone in its entry (`Makefile`). Its descriptions are
  *   not read: "covers pass/fail", "JSON, YAML" or a directory named in passing
  *   is no path. An entry of its own with no backticks (", .gitignore") counts
  *   by its first word, and only when that is clearly a file or a directory.
@@ -331,8 +332,11 @@ export function fieldPaths(text) {
   for (const raw of masked.split(/[,\n]/)) {
     const entry = raw.trim().replace(/^[-*]\s+/, '');
     if (entry === '') continue;
-    const ticked = [...entry.matchAll(/\u0000(\d+)\u0000/g)].map((m) => Number(m[1])).filter((i) => isTicked[i]);
+    const inEntry = [...entry.matchAll(/\u0000(\d+)\u0000/g)].map((m) => Number(m[1]));
+    const ticked = inEntry.filter((i) => isTicked[i]);
     if (ticked.length) { out.push(...ticked.map((i) => spans[i])); continue; }
+    // A backticked `Makefile` alone in its entry is a file (round 6).
+    if (inEntry.length === 1 && /^\u0000\d+\u0000$/.test(entry) && BARE_NAME.test(spans[inEntry[0]])) { out.push(spans[inEntry[0]]); continue; }
     const words = entry.split(/\s+/).filter((w) => !w.includes('\u0000')).map(plainWord).filter(Boolean);
     if (tickedField) {
       const first = plainWord(entry.split(/\s+/)[0]);
@@ -371,15 +375,23 @@ export function stepTestsOnly(body) {
   return stepTestsOnlyFromFields(parseStepFields(body));
 }
 
-/** `stepTestsOnly` for a caller that already holds the step's parsed fields. */
-export function stepTestsOnlyFromFields(f) {
-  const files = f.has('Files') ? fieldPaths(f.get('Files').text) : [];
+/**
+ * Whether a path counts as a test for this step: its own `Test first:` file, or
+ * a path that is clearly a test. red-proof.mjs uses it on the step's diff.
+ * @returns {(path: string) => boolean}
+ */
+export function stepTestFile(f) {
   const testFirst = f.has('Test first')
     ? [...f.get('Test first').text.matchAll(/\bFile:\**[ \t]*`([^`\n]+)`/gi)].map((m) => norm(m[1].trim()))
     : [];
-  const isTest = (p) => testFirst.includes(p) ||
+  return (p) => testFirst.includes(p) ||
     (isTestPath(p) && (UNDER_TESTS_RE.test(p) || !(DOC_RE.test(p) || DATA_RE.test(p))));
-  return { testsOnly: files.length > 0 && files.every(isTest), files };
+}
+
+/** `stepTestsOnly` for a caller that already holds the step's parsed fields. */
+export function stepTestsOnlyFromFields(f) {
+  const files = f.has('Files') ? fieldPaths(f.get('Files').text) : [];
+  return { testsOnly: files.length > 0 && files.every(stepTestFile(f)), files };
 }
 
 // ---- sections (fence-aware) ------------------------------------------------