fix(conformance): report restricted Unix producer exit status

[BunsDev]

Report a restricted Unix producer's nonzero exit status immediately after wait, before containment drain. Preserve the numeric status if cleanup later fails while retaining containment checks, the final failure guard, and bounded producer diagnostics. Windows already forwards child output and remains unchanged.

Update the trusted script digest, documented metadata, and immutable harness authority. The authority binds signed combined behavior 4a700bce4217536b294fd2d2c58f579459685484; preserve that commit in repository history when landing. Current main's Cave timestamp diagnostics are retained.

Regression tests execute the real completion block on Linux and Darwin branches. Address review by skipping this Bash-only suite on Windows and accepting a source match at index zero.

Validation on final head:

• 579 normal tests passed, 61 existing skips, with two workers. A Git-backed fixture first hit its five-second timeout under full parallel load; its isolated retry and the full two-worker run passed without changing timeouts.
• 419 heavy tests passed, 35 existing platform skips.
• Typecheck, lint, build, shell syntax, and diff checks passed.
• All 25 authority files and 10 production deltas verified against signed Git objects.

This is diagnostic improvement, not a fix for the protected run's producer failures. A subsequent SDK validator rebind is required before protected dispatch consumes the merged producer.

[Copilot]

🟡 Changes recommended

The new test suite invokes bash without skipping on Windows and uses an overly strict indexOf() assertion, which can cause avoidable cross-platform test failures and brittleness.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR improves Phase 1 conformance diagnostics on Unix by reporting a restricted producer’s non-zero exit status immediately after wait, before containment drain/cleanup can overwrite the failure signal, and updates the lock/authority metadata that pins the trusted harness bytes.

Changes:

• Emit a new stderr line with the restricted producer’s numeric exit status right after wait.
• Update harness authority revision/tree and pinned blob/SHA-256 metadata across the lock file, tests, docs, and the trusted workflow.
• Add a regression test that executes the real completion block and asserts stderr ordering and continued cleanup behavior.

File summaries

File	Description
src/unix-producer-exit-status.test.ts	New regression test that runs the extracted supervisor completion block and asserts stderr ordering for failure/success paths.
scripts/unix-producer-supervisor.sh	Prints the restricted producer’s non-zero exit status immediately after wait and before containment drain.
src/phase1-conformance-lock.test.ts	Updates expected harness authority revision/tree and pinned file blob/SHA-256 values.
phase1-conformance.lock.json	Updates harness revision and harnessAuthority revision/tree plus pinned blob/SHA-256 values.
docs/phase1-conformance.md	Updates documented SHA-256/size metadata and documents the new Unix supervisor stderr behavior.
.github/workflows/client-v1-conformance.yml	Updates expected supervisor script size/SHA-256 in the trusted workflow verifier logic.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.