fix: round 4 of the release review of 6.3.0

Round 4 (v6.2.0..41ea8fc, WARN: 9 MAJOR, 3 MINOR); the nine MAJOR fixed,
each behind a test that failed first (operator 2026-10-10). Three were
regressions from round 3's shared Files: reader.

- fieldPaths keeps a backticked path with punctuation after it and one
  inside a note, a directory (docs/) and a glob (src/*.mjs) in plain text,
  and app/(auth)/x.ts whole; a bare word counts only alone and capitalised
  (Makefile), so "format" or "v6.3.0" in a description is no path. The K6
  sweep plans what v6.2.0 planned for `a.mjs`: and `b.mjs`.
- skill frontmatter: a quoted value may carry a YAML comment after it.
- criteria runner: no word with a leading ~ (sh expands it), and nothing
  after `make test` (another target would run).
- release-check: scope_sha_end must be a commit sha (a ref name passed
  coverage whatever was reviewed), and README lines changed after the review
  may differ only in the badge's version. The round-3 leading-zero example
  is 7 characters now, the shortest sha accepted.

The three MINOR (one word screen for git, the exec copy in regression-check,
a shared isMain helper) are not in this round.

Suite 2175 (2173/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/scripts/release-check.test.mjs

@@ -408,6 +408,30 @@ test('release-check r3 — the review and the approval log committed after the r
 test('release-check r3 — scope_sha_end is read as written: an all-digit sha keeps its leading zero', () => {
   assert.equal(typeof mod.reviewedSha, 'function');
   assert.equal(mod.reviewedSha('---\ntype: trekreview\nscope_sha_end: 0123456\n---\nbody\n'), '0123456');
-  assert.equal(mod.reviewedSha('---\nscope_sha_end: "00ab12"\n---\n'), '00ab12');
+  assert.equal(mod.reviewedSha('---\nscope_sha_end: "00ab12c"\n---\n'), '00ab12c');
   assert.equal(mod.reviewedSha('---\ntype: trekreview\n---\nscope_sha_end: 1\n'), '', 'only the frontmatter counts');
 });
+
+// ==== round 4 of the release review of 6.3.0 (2026-10-10) ====================
+
+test('release-check r4 — scope_sha_end must be a sha: a ref name fails coverage → 1', () => {
+  assert.equal(mod.reviewedSha('---\nscope_sha_end: HEAD\n---\n'), '');
+  assert.equal(mod.reviewedSha('---\nscope_sha_end: main\n---\n'), '');
+  const fx = fixture({ reviewSha: 'HEAD' });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 1, r.stdout + r.stderr);
+    assert.match(r.stdout, /scope_sha_end/);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check r4 — other text on the badge line is not release bookkeeping → 1', () => {
+  const fx = fixture({ afterRelease: {
+    'README.md': '# fx\n\n![Version](https://img.shields.io/badge/version-1.0.1-blue) [install](https://example.invalid/i.sh)\n\nText.\n',
+  } });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 1, r.stdout + r.stderr);
+    assert.match(r.stdout, /README\.md/);
+  } finally { fx.cleanup(); }
+});