fix: round 6 of the release review of 6.3.0

Round 6 (v6.2.0..c3641ff, WARN: 11 MAJOR, 3 MINOR; 0 BLOCKER). The round-5
fixes hold (code-correctness-reviewer); three of the new MAJOR were side
effects of running checks with no shell. Each fixed behind a test that
failed first on c3641ff.

- git checks stay in the repo too: no path that climbs out with .., starts
  at / or reads <rev>:../x, and no --no-index (both reviewers).
- A trailing `# comment` on a shell-fence line is dropped: with no shell,
  its words made an honest check NOT RUN, among them the first check of the
  shipped example plan.
- A glob reaches `node --test` only on Node 21 and later, which expands it
  itself; on an older Node it is refused with that reason (engines >=18).
- With no shell, exit 126/127 is the test program's own: red proof reads it
  as a red (the control run still tells an environment fault apart), the
  done line and the test lock as a failure.
- A runner that could not start (not installed) is NOT RUN in the criteria
  runner and not-run (exit 2) in regression-check, as red-proof and
  done-line already said; never a red suite.
- Tests-only: a backticked `Makefile` alone in its entry is a path, and red
  proof confirms the plan's tests-only reading against the step's own diff
  (the altitude finding: the diff is a fact, the Files: prose is not).
- release-check stops a suite that never ends (15 minutes) and reads it as
  not measured (exit 2).
- The two lines this release added to pre-bash-executor.mjs are ASCII.
- MINOR: git and the other runners share one plain-word pattern.

Not in this round: MINOR f00a2eb8 (shared norm/ticked-path and isMain
helpers) and MINOR on plan-review-dedup's repeated tokenizing.

Suite 2194 (2192/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/scripts/release-check.test.mjs

@@ -449,3 +449,16 @@ test('release-check r5 — a test moved into an allowed place after the review i
     assert.match(r.stdout, /guard\.test\.mjs/);
   } finally { fx.cleanup(); }
 });
+
+// ==== round 6 of the release review of 6.3.0 (2026-10-11) ====================
+
+test('release-check r6 — a suite that never ends is stopped and read as not measured → 2', () => {
+  const fx = fixture({ testScript: 'node -e "setTimeout(() => {}, 4000)"' });
+  try {
+    const r = mod.releaseCheck({ repo: fx.repo, review: fx.review, suiteTimeoutMs: 1000 });
+    const suite = r.checks.find((c) => c.id === 'suite');
+    assert.equal(suite.status, 'error', JSON.stringify(suite));
+    assert.match(suite.detail, /timeout|killed/i);
+    assert.equal(r.exit, 2);
+  } finally { fx.cleanup(); }
+});