fix(scripts/pm): give os-verify-lock.sh the index execute bit its own header documents - #19050

Fixes #19044

Clause-②: no

scripts/pm/os-verify-lock.sh goes 100644 → 100755 in the index. Content is
byte-identical: the blob id is 8ad1813feff415727c4bd16f834707d20c6fc34c before and
after, so the diff adds and removes nothing.

⚠️ Deviation from the dispatched file surface — one file, not three

The dispatch named three modes to flip. The criterion the card asks for first was
measured before any edit, and it places one of them. The two siblings are left at
100644 on purpose.

Their own headers do not document a bare-path invocation. Verbatim, from the usage
blocks:

So the card's two "controls" widened the mode reading (all three are 100644 — true,
re-measured here) but they do not widen the class-(b) contract violation: there is
exactly one script in this repo whose own documented spelling the tracked mode refuses.
The card itself set the boundary this follows — 「A blanket +x over everything would be
the same unexamined move in the other direction」 — and flipping two files whose documented
spelling was never refused is that move, scoped to one lane.

The criterion, measured

A bare-path invocation SITE is what needs the bit — not a header's prose, and not a
lane's habit. Two kinds of such site exist in this repo, and nothing else executes a
tracked .sh by bare path:

1. .claude/settings.json hook commands — 5 of them, each spelled as the quoted path with
   no interpreter. All five files are already 100755.
2. scripts/pm/os-verify-lock.sh's own usage block (5 lines), plus the PM dispatch
   instruction at .claude/skills/pm-dispatch/SKILL.md:438, which spells the full
   bare path scripts/pm/os-verify-lock.sh --status.

Every other execution site spells bash PATH: 17 workflow run: lines (including
lint.yml:1698 and lint.yml:1779, the self-test gates for two of these three scripts)
and 9 package.json script entries. Both .githooks/ references are prose, not calls.

⭐ That second site is the one the triage comment flagged as its source-side upgrade
condition — 「若测到另有文档/模板/派发令在教人用直调拼法」. It exists:
SKILL.md:438 teaches the refused spelling to the PM seat. This PR resolves that
condition rather than escalating it (the spelling now runs), and the reading is handed
to the seat rather than acted on: priority is not this PR's to move.

Every tracked .sh — mode · shebang · does its header document a bare path

All 29 tracked .sh files carry the shebang #!/usr/bin/env bash. Header = first 40 lines,
self-path in command-word position.

Counts on origin/main at abb01f105: 29 tracked .sh — 22 at 100755, 7 at
100644. (The triage comment's contrast figure of 24 is off by two; the card's and the
dispatch's three scripts/pm/ rows re-measure exactly.)

⇒ After this PR the criterion holds with zero violations across all 29 files, which is
the state shape C would assert if a gate were ever taken. Shape C is not taken here.

Exit codes — before / after, bash PATH as the control both times

Measured in this worktree, branched from origin/main at abb01f105.

And the two files left at 100644, showing the absence of a violation in both directions:

Reader test (one line): a dev copies scripts/pm/os-verify-lock.sh --status out of the
header, pastes it at a worktree root, and it prints the lock state and exits 0 — on this
branch it does; on origin/main it prints Permission denied and exits 126.

The diff

$ git diff --summary abb01f105 HEAD
 mode change 100644 => 100755 scripts/pm/os-verify-lock.sh

$ git diff --stat abb01f105 HEAD
 scripts/pm/os-verify-lock.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)

⚠️ One correction to a stated expectation: git diff --stat on a mode-only change is not
empty — it prints the file with a zero-width graph and 0 insertions(+), 0 deletions(-).
--summary is the line that carries the change.

Mechanism this is built on, measured not assumed

• No gate or CI job reads a scripts/pm/** file mode. Grepping 100755 / 100644 /
  fileMode / update-index --chmod / X_OK over scripts/**, .github/workflows/**,
  packages/lint/**, .githooks/** and .claude/hooks/** returns mode assertions for
  exactly two paths, both under .githooks/: check-regen-pending.mjs:1615 asserts
  .githooks/pre-push is 100755, and git-merge-regen.mjs:1212 asserts the same for
  .githooks/pre-commit. Both prescribe the fix as git update-index --chmod=+x — this
  repo already treats an index execute bit as an assertable contract, with this exact
  remedy, so shape A's mechanism is the sanctioned one and not a new idea.
• A mode-only diff is already pinned as clean by the widening-tells gate:
  scripts/pm/check-widening-tells.mjs:4263 pins 「a MODE-ONLY change carries a real 0」 and
  :4280 pins that a mode-only change to a tell surface is clean.
• Shebangs: all three scripts/pm/*.sh are #!/usr/bin/env bash, so the newly
  executable file runs under bash, not sh. All 29 tracked .sh carry the same shebang.
• core.fileMode is true in this worktree, so chmod +x plus git add was the
  spelling used; git ls-files -s confirms the index carries 100755, and the worktree
  and index agree (no phantom "mode change back" in git status).
• Serial safety: the two self-test gates that run these scripts in CI
  (lint.yml:1698, lint.yml:1779) both spell bash PATH, so neither is affected in
  either direction by a mode flip.

Acceptance notes

Observations from the criterion sweep, not filed and not changed here:

• The 100644 / 100755 split among the files with no bare-path site is arbitrary
  drift, not a rule: scripts/ci/select-shard-packages.sh is 100755 while its sibling
  scripts/ci/select-gate-families.sh is 100644, and both are invoked only as
  bash PATH from lint.yml / ci.yml. Two of the three scripts/ci/*.selftest.sh are
  100644, the scripts/ selftests elsewhere are 100755. Nothing is broken by it and no
  declared contract is crossed — the criterion is one-directional, so a file carrying +x
  it does not need is not a violation.
• scripts/pm/os-regen-merge.sh:393 spells its --help usage with a bare basename
  (os-regen-merge.sh --self-test), which would not run even with the bit set, since the
  basename is not on PATH. It is a usage label, not a path invocation, so it is outside
  the criterion — noting it as the boundary, not widening the class.
• scripts/pm/ is 27 × 100644 and 1 × 100755 (release-rehearsal-clone.mjs), so
  「+x is the repo's convention」 is true repo-wide for .sh (22 of 29) and false for this
  lane. The criterion, not the lane habit, is what places the bit.

Changeset

skip-changeset: scripts/pm/** publishes nothing — no package's files[] ships it, and
the diff is a file mode, so no released byte moves. Fast-track path, no measurement needed.

Generated by Claude Code