v1.91.85.0 fix(cso,deploy): /cso on Windows Git 2.56 and macOS Docker, zsh-safe loops, honest deploy stops (Wave 9 Lane D) (#3134)

/cso sets GIT_CONFIG_GLOBAL=/dev/null on every platform (Git for Windows 2.56
rejects NUL), shared by childEnvironment and the eval and producer Git
environments, with a Windows-safe test that `git config --global --list` is
empty. On macOS the local Docker socket resolves without opening it when Bun's
realpathSync throws EOPNOTSUPP; Linux admission and the local-Unix-only rule
are unchanged. /test-audit and /ship loop over file lists zsh does not
word-split, with a static test against `for x in $VAR` in generated bash.
/setup-deploy stops and writes nothing when nothing is deployed yet;
/land-and-deploy runs a recorded command trigger only with explicit approval
before claiming revision proof. TODOS.md records the open P2/P3 bugs by area,
the Wave 9 parked items and the feature themes.

Closes #3082. Adopts #3094, #3095, #3096 and #3109.

Co-authored-by: marcode <244097767+vilano93@users.noreply.github.com>
Co-authored-by: Nathan <196341+nathanshox@users.noreply.github.com>
Co-authored-by: mikehasa <91774998+mikehasa@users.noreply.github.com>
Co-authored-by: Andrey <95643518+Alfabit7@users.noreply.github.com>

scripts/cso-eval-producer.ts

@@ -6,7 +6,7 @@ import { execFileSync } from 'node:child_process';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { readBoundedStable } from '../lib/cso/bounded-file';
 import { CsoError } from '../lib/cso/contracts';
-import { executable, redact } from '../lib/cso/process';
+import { EMPTY_GLOBAL_GIT_CONFIG, executable, redact } from '../lib/cso/process';
 import { atomicWriteSync } from '../lib/fs-atomic';
 import { redactProducerText, sourceCredentialValues, type OutputRedaction } from './cso-eval-output-redaction';
 import { resolveClaudeCommand } from '../lib/claude-bin';
@@ -241,7 +241,7 @@ export function inventoryProducerArtifacts(helperHome: string): ProducerArtifact
 
 function repositoryIdentity(root: string): string {
   const nullPath = process.platform === 'win32' ? 'NUL' : '/dev/null';
-  const env = { PATH: process.env.PATH ?? '', LANG: 'C', LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: nullPath, GIT_ATTR_NOSYSTEM: '1', GIT_OPTIONAL_LOCKS: '0' };
+  const env = { PATH: process.env.PATH ?? '', LANG: 'C', LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: EMPTY_GLOBAL_GIT_CONFIG, GIT_ATTR_NOSYSTEM: '1', GIT_OPTIONAL_LOCKS: '0' };
   const git = executable('git');
   const config = readBoundedStable(join(root, '.git', 'config'), 1024 * 1024, 'Producer Git configuration').toString('utf8');
   if (/^\s*\[\s*include(?:if)?(?=[\s."\]])/im.test(config)) throw sourceError('.git/config', 'contains an include directive');

scripts/cso-eval.ts

@@ -7,7 +7,7 @@ import { dirname, join, resolve } from 'node:path';
 import { readBoundedStable } from '../lib/cso/bounded-file';
 import { canonical } from '../lib/cso/contracts';
 import { validateRuntimeCatalog, type RuntimeCatalog } from '../lib/cso/runtime-catalog';
-import { executable } from '../lib/cso/process';
+import { EMPTY_GLOBAL_GIT_CONFIG, executable } from '../lib/cso/process';
 import { atomicWriteSync } from '../lib/fs-atomic';
 import { loadCorpusManifest, materializeCase, publicCorpus, STACKS, validateCorpusManifest, type CorpusManifest, type EvalCorpus, type EvalStack, type EvalVariant } from '../test/fixtures/cso-eval/materialize';
 import {
@@ -317,7 +317,7 @@ function initializeFixtureRepository(path: string): void {
   const nullPath = process.platform === 'win32' ? 'NUL' : '/dev/null';
   const env = {
     PATH: process.env.PATH ?? '', LANG: 'C', LC_ALL: 'C',
-    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: nullPath, GIT_ATTR_NOSYSTEM: '1',
+    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: EMPTY_GLOBAL_GIT_CONFIG, GIT_ATTR_NOSYSTEM: '1',
     GIT_AUTHOR_NAME: 'CSO Eval', GIT_AUTHOR_EMAIL: 'cso-eval@invalid',
     GIT_COMMITTER_NAME: 'CSO Eval', GIT_COMMITTER_EMAIL: 'cso-eval@invalid',
   };

scripts/resolvers/testing.ts

@@ -229,7 +229,7 @@ trap cleanup EXIT INT TERM
   git -C "$ROOT" remote get-url origin >/dev/null 2>&1 || { echo "BASE_CONTROL: unavailable (no base remote)"; exit 0; }
   timeout 30 git -C "$ROOT" fetch --quiet origin "$BASE" || { echo "BASE_CONTROL: unavailable (base not fetched)"; exit 0; }
   git -C "$ROOT" worktree add --quiet --detach "$CTL_TMP/wt" "origin/$BASE" >/dev/null 2>&1 || { echo "BASE_CONTROL: unavailable (worktree add failed)"; exit 0; }
-  for f in $TEST $FIXTURES; do mkdir -p "$CTL_TMP/wt/$(dirname "$f")" && cp "$ROOT/$f" "$CTL_TMP/wt/$f"; done
+  for f in $(echo "$TEST $FIXTURES"); do mkdir -p "$CTL_TMP/wt/$(dirname "$f")" && cp "$ROOT/$f" "$CTL_TMP/wt/$f"; done
   [ -d "$ROOT/node_modules" ] && ln -s "$ROOT/node_modules" "$CTL_TMP/wt/node_modules"
   cd "$CTL_TMP/wt" && timeout "\${BUDGET:-90}" sh -c "$RUN" > "$CTL_TMP/out" 2>&1; rc=$?
   tail -n 40 "$CTL_TMP/out"

scripts/ubicloud/setup-free-suite.sh

@@ -10,7 +10,7 @@ NODE_VERSION=22.20.0
 export DEBIAN_FRONTEND=noninteractive
 sudo -E apt-get update -qq
 sudo -E apt-get install -y -qq --no-install-recommends \
-  git curl unzip xz-utils ca-certificates build-essential clang python3-venv jq \
+  git curl unzip zip xz-utils ca-certificates build-essential clang python3-venv jq \
   xvfb x11-utils poppler-utils fonts-noto-color-emoji zsh >/dev/null
 
 # Ubuntu 24.04 blocks unprivileged user namespaces, which Chromium's sandbox