[hzw0813]

Static inspection could execute configured Git clean filters through the immutable-workspace check, and wildcard filenames or truncated patches could corrupt per-file evidence. The baseline's 154 passing tests did not cover these paths. This PR adds 16 regressions and fixes the highest-impact failures found in the production-readiness audit.

Changes:

• Share one static Git boundary across diff, workspace alignment, and test-map reads; refresh bounded, NUL-delimited driver discovery including linked-worktree config.
• Reject incomplete Git output and patch errors; preserve literal filename/rename identity and support unborn SHA-256 repositories.
• Handle early child-stdin closure without crashing; reject Python output from failed, timed-out, or truncated helpers.
• Preserve inventory order when collecting concurrent parsing results.
• Move test preparation to npm pretest, retain direct serial test targeting, and repair dogfood to require positive compiled-target observations while preserving partial TypeScript source evidence. Run this gate in PR CI.
• Update security/architecture/troubleshooting/contributor documentation, record the audit and remaining boundaries, and regenerate tracked dist.

Validation completed locally on Linux / Node 24.19.0 / Git 2.51.1 / Python 3.12.14, with the unchanged lockfile:

• npm ci --ignore-scripts: passed.
• npm run typecheck and npm run lint: passed (lint is the existing TypeScript typecheck alias).
• npm test: 170 passed, 0 failed, 0 skipped. Eleven added cases were observed failing before their fixes.
• npm run test:action: passed, including production-only installation and the static/execution/report trust boundary smoke tests.
• npm run dogfood: all 4 checks passed; all 7 related compiled targets had positive observations; source evidence correctly remained partially verified.
• npm run demo: all 4 expected scenario outcomes passed. Generated examples were restored after validation to avoid unrelated stale-example/timing churn.
• npm pack --dry-run: passed, including its clean-build and full 170-test prepack lifecycle.
• Clean rebuild: staged dist matched byte-for-byte, with no untracked generated files; git diff --check passed.
• npm audit: 0 reported vulnerabilities at validation time.

Cross-platform CI passed on final head a68cd22ec75d0efdd2f8c315d67fc4d0575bc5bc: CI run #240. All 12 applicable jobs passed, including all 9 Linux/macOS/Windows × Node 22/24/26 test-and-package combinations, source/dist parity, Action smoke with dogfood, and PR evidence generation. The published-release Action job is intentionally push-only and was skipped.

The first CI run caught global CRLF conversion in the new Windows linked-worktree fixture. Its repository attributes now explicitly require LF, preserving the fail-closed production alignment rule; the corrected fixture and full 170-test suite were rerun locally, and the final cross-platform matrix is green.

No new dependencies, runtime LLM/network/telemetry/source-upload behavior, automatic repository execution, or evidence status changes. Large/incomplete Git reads now exit 2 rather than yielding partial evidence. The audit in docs/production-readiness-audit.md records remaining limits, including submodules, filesystem snapshot isolation, and unsupported runner/resolver forms. This is a hardening pass, not a universal production-readiness certification.