fix: round 6 of the release review of 6.3.0

Round 6 (v6.2.0..c3641ff, WARN: 11 MAJOR, 3 MINOR; 0 BLOCKER). The round-5
fixes hold (code-correctness-reviewer); three of the new MAJOR were side
effects of running checks with no shell. Each fixed behind a test that
failed first on c3641ff.

- git checks stay in the repo too: no path that climbs out with .., starts
  at / or reads <rev>:../x, and no --no-index (both reviewers).
- A trailing `# comment` on a shell-fence line is dropped: with no shell,
  its words made an honest check NOT RUN, among them the first check of the
  shipped example plan.
- A glob reaches `node --test` only on Node 21 and later, which expands it
  itself; on an older Node it is refused with that reason (engines >=18).
- With no shell, exit 126/127 is the test program's own: red proof reads it
  as a red (the control run still tells an environment fault apart), the
  done line and the test lock as a failure.
- A runner that could not start (not installed) is NOT RUN in the criteria
  runner and not-run (exit 2) in regression-check, as red-proof and
  done-line already said; never a red suite.
- Tests-only: a backticked `Makefile` alone in its entry is a path, and red
  proof confirms the plan's tests-only reading against the step's own diff
  (the altitude finding: the diff is a fact, the Files: prose is not).
- release-check stops a suite that never ends (15 minutes) and reads it as
  not measured (exit 2).
- The two lines this release added to pre-bash-executor.mjs are ASCII.
- MINOR: git and the other runners share one plain-word pattern.

Not in this round: MINOR f00a2eb8 (shared norm/ticked-path and isMain
helpers) and MINOR on plan-review-dedup's repeated tokenizing.

Suite 2194 (2192/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/verification/regression-check.mjs

@@ -9,7 +9,9 @@
 //     1 = it failed, the executor denylist blocked it, or it is not runnable
 //         (no command, or a command outside the test-runner allowlist): the
 //         step is not done, and that is a finding for the fix rounds
-//     2 = could not run: bad usage, a plan that cannot be read, no step N
+//     2 = could not run: bad usage, a plan that cannot be read, no step N, or
+//         a runner that could not start (not installed): nothing was measured,
+//         as red-proof and done-line say for the same case
 //   JSON on stdout: {step, status, progress_status, command, exit_code, output}
 //     status: passed | failed | blocked | unrunnable | absent | error
 //     progress_status: the value progress.json takes for steps.N.regression
@@ -55,13 +57,15 @@ export function checkRegression({ planText, step, cwd = process.cwd(), run = (c,
   if (!field) return withProgress({ ...base, status: 'absent', output: 'no Regression: field — nothing to run', exit: EXIT.absent });
   const { command, reason } = firstCommand(field.text);
   const [r] = run([{ label: `R${step}`, text: field.text, command, reason }], { cwd });
+  // A runner that could not start measured nothing: not a red suite (round 6).
+  const status = r.startError ? 'error' : r.status;
   return withProgress({
     step,
-    status: r.status,
+    status,
     command: r.command ?? null,
     exit_code: r.exitCode ?? null,
     output: r.output ?? '',
-    exit: EXIT[r.status] ?? EXIT.error,
+    exit: EXIT[status] ?? EXIT.error,
   });
 }