fix: round 6 of the release review of 6.3.0

Round 6 (v6.2.0..c3641ff, WARN: 11 MAJOR, 3 MINOR; 0 BLOCKER). The round-5
fixes hold (code-correctness-reviewer); three of the new MAJOR were side
effects of running checks with no shell. Each fixed behind a test that
failed first on c3641ff.

- git checks stay in the repo too: no path that climbs out with .., starts
  at / or reads <rev>:../x, and no --no-index (both reviewers).
- A trailing `# comment` on a shell-fence line is dropped: with no shell,
  its words made an honest check NOT RUN, among them the first check of the
  shipped example plan.
- A glob reaches `node --test` only on Node 21 and later, which expands it
  itself; on an older Node it is refused with that reason (engines >=18).
- With no shell, exit 126/127 is the test program's own: red proof reads it
  as a red (the control run still tells an environment fault apart), the
  done line and the test lock as a failure.
- A runner that could not start (not installed) is NOT RUN in the criteria
  runner and not-run (exit 2) in regression-check, as red-proof and
  done-line already said; never a red suite.
- Tests-only: a backticked `Makefile` alone in its entry is a path, and red
  proof confirms the plan's tests-only reading against the step's own diff
  (the altitude finding: the diff is a fact, the Files: prose is not).
- release-check stops a suite that never ends (15 minutes) and reads it as
  not measured (exit 2).
- The two lines this release added to pre-bash-executor.mjs are ASCII.
- MINOR: git and the other runners share one plain-word pattern.

Not in this round: MINOR f00a2eb8 (shared norm/ticked-path and isMain
helpers) and MINOR on plan-review-dedup's repeated tokenizing.

Suite 2194 (2192/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/release-check.mjs

@@ -156,10 +156,16 @@ function checkTree(repo) {
   return { id: 'tree', status: 'pass', detail: 'working tree clean' };
 }
 
-function checkSuite(repo, treeClean) {
+// A suite that never ends is stopped, as every other check runner here stops
+// its command (15 minutes), and read as not measured (release review of
+// 6.3.0, round 6): the operator always gets an answer.
+export const SUITE_TIMEOUT_MS = 900_000;
+
+function checkSuite(repo, treeClean, timeoutMs = SUITE_TIMEOUT_MS) {
   if (!treeClean) return { id: 'suite', status: 'fail', detail: 'suite not run: the tree has uncommitted changes, so it would not measure HEAD' };
   // commandEnv: under a parent `node --test` the suite would report to it and exit 0 whatever it found.
-  const r = spawnSync('npm', ['test'], { cwd: repo, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, env: commandEnv() });
+  const r = spawnSync('npm', ['test'], { cwd: repo, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, env: commandEnv(), timeout: timeoutMs });
+  if (r.signal) return { id: 'suite', status: 'error', detail: `npm test was killed (${r.signal}) after the ${Math.round(timeoutMs / 1000)} s timeout — not measured` };
   if (r.error) return { id: 'suite', status: 'error', detail: `npm test could not start: ${r.error.message} — not measured` };
   const out = `${r.stdout ?? ''}\n${r.stderr ?? ''}`;
   const summary = out.split('\n').filter((l) => /^ℹ (tests|pass|fail|skipped) /.test(l)).map((l) => l.slice(2));
@@ -263,7 +269,7 @@ function resolveVersion(repo, explicit) {
  * Run every check. Pure of process exit; the CLI below prints and exits.
  * @returns {{ exit: 0|1|2, version: string|null, repo: string, checks: object[], reason?: string }}
  */
-export function releaseCheck({ repo, review, version: explicitVersion }) {
+export function releaseCheck({ repo, review, version: explicitVersion, suiteTimeoutMs }) {
   const top = git(repo, ['rev-parse', '--show-toplevel']);
   if (top.error || top.status !== 0) return { exit: EXIT.UNDECIDED, version: null, repo, checks: [], reason: `${repo} is not a git repository` };
   // The plugin's own directory, not the git top level: a plugin may sit in a
@@ -281,7 +287,7 @@ export function releaseCheck({ repo, review, version: explicitVersion }) {
   const undecided = [tree, rev, coverage, door].filter((c) => c.status === 'error');
   const suite = undecided.length > 0
     ? { id: 'suite', status: 'skip', detail: `not run: ${undecided.map((c) => c.id).join(', ')} could not be measured, so the answer is exit 2 already` }
-    : checkSuite(root, tree.status === 'pass');
+    : checkSuite(root, tree.status === 'pass', suiteTimeoutMs);
   const checks = [tree, suite, rev, coverage, door];
 
   let exit = EXIT.READY;