fix(#223): add platform detection to gitleaks install in post-scripts

[fullsend-ai-coder]

Summary

Adds platform detection and shared gitleaks install library for post-scripts.

Changes

• New shared lib scripts/lib/gitleaks-install.lib.sh — consolidates gitleaks_sha256(), resolve_platform(), verify_checksum(), and install_gitleaks() into a single source, eliminating duplication across post-code.src.sh and post-fix.src.sh
• Platform-aware gitleaks download — detects OS (Linux/Darwin) and architecture (x64/arm64) via uname, replacing the hardcoded linux_x64 binary URL
• Fail-fast install — uses explicit if ! ... || ! ... chain with mktemp instead of && chain with fixed /tmp/gitleaks.tar.gz
• SHA-256 verification — supports both sha256sum (Linux) and shasum (macOS)
• Bash 3.2 compatibility — uses case statements (not declare -A), while-read loops (not mapfile), for macOS system bash support
• New test file scripts/gitleaks-install-test.sh — 26 tests covering platform detection (8 OS/arch combos), checksum lookup, verify_checksum, version drift guard, and function drift guard
• Bundled script verification — post-code-test.sh and post-fix-test.sh assert install_gitleaks is present in bundled output

Platforms supported

Platform	Checksum verified
linux_x64	Yes (official 8.30.1 release)
linux_arm64	Yes
darwin_x64	Yes
darwin_arm64	Yes

Dependencies

Depends on #38 (script bundling infrastructure). PR diff will shrink once #38 merges into main.

---

Closes #223

[waynesun09]

Review squad (round 3) — all CI green, no surviving findings.

Review coverage:

• claude-researcher: completed — NO findings at MEDIUM or above. All 4 SHA256 checksums independently verified against official gitleaks 8.30.1 release checksums. Platform mappings confirmed for all GitHub runner types. All code-comment claims verified true.
• claude-coder, grok-review-agent: failed (API rate limits) — not counted.

Prior rounds fixed:

• Round 1: replaced declare -A (bash 4+) with case-based gitleaks_sha256() function; replaced mapfile with while-read loops; hardened install chain from && to explicit if ! ... || ! ... with mktemp + cleanup; rewrote test suite to extract production functions instead of hand-copying
• Round 2: fixed shellcheck CI (SC2317, SC2123 directives); fixed bash 3.2 $() lexer issues with balanced case patterns and apostrophe-free comments

CI status: commit-lint, DCO, detect, script-test, test — all pass.
Test coverage: 87/87 pass under bash 3.2.57 and bash 5.x; post-fix-test.sh clean.

[waynesun09]

CI note: script-test fails because this PR depends on #38 (script bundling infrastructure). Our branch includes #38's commits, but CI merges against main which doesn't have the bundler yet — make check-bundle fails on the merge commit.

Once #38 merges into main, this PR's CI will pass. The check-bundle and script-test failures are expected until then.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:41 PM UTC · Completed 1:57 PM UTC
Commit: a41af5c · View workflow run →

[fullsend-ai-retro]

Retro: PR #225 — Platform detection for gitleaks install

Timeline

1. Jul 16 17:27 — Issue #223 created by waynesun09. Extremely detailed: exact SHA-256 checksums for 4 platforms, implementation approach (declare -A associative arrays), test requirements, and cross-references to upstream scan-secrets code.
2. Jul 16 17:28–17:31 — Triage agent runs (~4 min). Produces summary faithfully repeating the declare -A recommendation without flagging bash 3.2 incompatibility.
3. Jul 16 17:32–17:42 — Code agent runs (~10 min). Creates PR fix(#223): add platform detection to gitleaks install in post-scripts #225 with initial implementation using declare -A and mapfile as the issue suggested.
4. Jul 16 17:42 — PR created. Fullsend dispatch runs on pull_request_target but skips all steps after stage determination — no automated review agent is triggered.
5. Jul 16 17:42–22:19 (~4.5 hours) — Human (waynesun09) manages 3 rounds of ad-hoc review squads:
   • Round 1: Replaced declare -A (bash 4+) with case-based function; replaced mapfile with while-read loops; hardened install chain; rewrote test suite
   • Round 2: Fixed shellcheck CI (SC2317, SC2123); fixed bash 3.2 $() lexer issues
   • Round 3: All clean, no findings (2/3 review agents failed due to API rate limits)
6. Jul 16 22:19 — PR approved by waynesun09.
7. Jul 19 13:31 — Rebased onto main after dependency PR feat(harness): report categorized post-script failures on issue/PR #38 merged.
8. Jul 19 13:39 — Merged via merge queue.

Assessment

What went well: The code agent delivered a structurally sound implementation in ~10 minutes — shared library extraction, platform detection, test suite, bundled-script verification. The final merged code is high quality (bash 3.2 compatible, 4-platform support, 87/87 tests passing). The very detailed issue specification enabled fast initial delivery.

What needed rework: The code agent used declare -A and mapfile (bash 4+ features) because the issue explicitly recommended them. However, the issue's stated goal was macOS support, which requires bash 3.2 compatibility. The code agent didn't catch this contradiction, leading to 2 rounds of human-driven fixes.

Review dispatch gap: Both fullsend dispatch runs (29520837344 on PR creation, 29539172777 on PR review) completed successfully but skipped all dispatch steps after stage determination. No automated review agent ran on this PR. The human compensated by running ad-hoc review squads, but this added ~4.5 hours of human effort.

Existing issue evidence

• Code agent should critically evaluate suggested fixes rather than implementing them verbatim #267 (Code agent should critically evaluate suggested fixes): This PR provides additional evidence. The code agent followed the issue's declare -A code suggestion over the implicit requirement for bash 3.2 compatibility — a variant of the "code examples dominating prose" pattern described in Code agent should critically evaluate suggested fixes rather than implementing them verbatim #267.
• Code agent should run issue-defined verification commands as a pre-submit check #286 (Code agent should run issue-defined verification commands): The issue included specific test requirements that, if executed, might have revealed bash version issues earlier.

Proposals filed

• Code agent should validate implementation against platform constraints stated in the issue (in fullsend-ai/agents)