fix: the second lekerepo trial's faults that made a result wrong or misleading

voyage-lekerepo trial 2 (2026-10-08), report section A; the operator decided
they are fixed before the next release:
- A1: a /code-review finding whose category is simplification, efficiency,
  style or readability enters as CODE_REVIEW_IMPROVEMENT (MINOR), not MAJOR.
- A2: recommended_action is the engine's own fix when transcribed, otherwise
  a test-first step; never the failure scenario dressed as a remedy.
- A3: a /code-review finding outside the exact range it was given is declined
  and listed, but no longer holds ALLOW back; /security-review's still does.
- A4: the manifest must_contain recipe uses grep -E -e ... -- so a pattern
  like --sep is not read as an option.
- A5: indented sub-points belong to their criterion (counted), and a
  criterion with sub-points and no command warns BRIEF_SC_SUBPOINTS.
- A6: a brief requiring bash 3.2 whose criterion runs plain bash warns
  BRIEF_SC_BASH_NOT_PINNED; /trekbrief proposes /bin/bash.
- A7: the plan template's and /trekplan's checkpoints stage the step's files.

Tests fail on 5f9faee first (tests/lib/trial2-fixes.test.mjs, 11 of 14).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/validators/brief-validator.mjs

@@ -270,8 +270,28 @@ export function validateBriefContent(text, opts = {}) {
   // judges by reading, and that stays allowed. Prose-only criteria (no
   // command) are not flagged.
   if (fm.type !== 'trekreview') {
+    // bash 3.2 required but measured under whatever `bash` is first on PATH:
+    // on a Mac with a newer bash installed that is 5.x, so the constraint is
+    // never measured (voyage-lekerepo trial 2, 2026-10-08).
+    const constraints = (extractSection(body, 'Constraints') ?? '') + (extractSection(body, 'Non-Functional Requirements') ?? '');
+    const needsBash32 = /\bbash\s*3\.2\b/i.test(constraints);
     for (const c of parseSuccessCriteria(body)) {
+      if (c.subpoints && !c.command) {
+        warnings.push(issue(
+          'BRIEF_SC_SUBPOINTS',
+          `Success criterion ${c.label} has ${c.subpoints} sub-point(s) and no command of its own: the review measures none of them`,
+          'Give the criterion one command that checks all its sub-points (`bash tests/<script>.sh` exits 0), ' +
+            'or write each sub-point as its own criterion with its own command.',
+        ));
+      }
       if (!c.command) continue;
+      if (needsBash32 && /^bash\s/.test(c.command)) {
+        warnings.push(issue(
+          'BRIEF_SC_BASH_NOT_PINNED',
+          `Success criterion ${c.label} runs \`${c.command}\`, but the brief requires bash 3.2: \`bash\` is whichever bash comes first on PATH, which may be newer`,
+          `Write it as \`/bin/bash ${c.command.replace(/^bash\s+/, '')}\` (/bin/bash tests/<script>.sh) so the check runs under the system bash.`,
+        ));
+      }
       const r = runnableCheck(c, { cwd: opts.cwd });
       if (r.runnable) continue;
       warnings.push(issue(