chore: promote next to main

[ss-o]

Promotion readiness record

Candidate identity

• Prior main SHA: 4574ced008f18a13bcb738bba07fc3dc8a5e011f

• Candidate next SHA: e8b5b57d8b231772f183c7c1cc9ffaaedbedd728

• Candidate tree SHA: ebdbf9908dd32764edd0a87fbd1787469933ec49

• Complete compare:
  main...next

• git diff --name-only <candidate-next>...<prior-main> produces no output.

• The candidate tree equals the recorded tree SHA.

Required validation

The Promotion gate check directly depends on every constituent below and
fails if any constituent fails, is cancelled, or is skipped.

Validation	Stable job name	Result
Zsh syntax and compile	Zsh syntax and compile	Passed
ZD ZUnit integration	ZD integration	Passed
Trunk	Trunk	Passed
CodeQL	CodeQL	Passed
Exact-candidate clean install and startup	Clean install and startup	Passed
Aggregate	Promotion gate	Passed

• The candidate SHA has not changed since every required check completed.
• The Guard main branch source and Promotion gate required contexts pass.
• The complete file and commit compare contains only reviewed work.

Before this pull request, the exact candidate had 58 retained successful check
runs, including the complete Zsh behavior suite, five ZD integration suites,
Trunk, and CodeQL. Local verification also passed all 12 focused behavior
tests, syntax and isolated compilation of all 39 tracked Zsh sources, clean
install and startup, actionlint, YAML parsing, and git diff --check.

Readiness review

Unresolved issues

No unresolved issue blocks promotion.

Issues #113, #386-#388, #429-#430, and #445-#449 remain independently
tracked. The high-priority defects #445 and #446 predate the current stable
main branch and are not regressions introduced by this candidate.

User-facing and migration notes

• Harden archive extraction against traversal and unsafe symlinks.
• Harden GitHub directory snippets against unsafe symlinks.
• Add GitHub /trunk/ directory support through transactional sparse Git.
• Make parallel updates deterministic.
• Correct Plugin Standard callback handling for effective plugin IDs.
• Rebuild message output behavior:
  • safe auto output is the default
  • normal messages use line feeds unless -n is requested
  • progress output owns carriage returns
  • dynamic text uses literal mode
  • invalid options and descriptors return status 2
• Correct hook ownership, MANPATH handling, and scheduler idle behavior.
• Add promotion ancestry and public-contract evidence checks.

The message-output change is intentionally breaking. The canonical wiki
documentation is already merged, and checked runtime consumers require no
pre-promotion adaptation.

Public-contract follow-ups

The canonical message-output documentation is current and the complete known
consumer inventory was manually verified. Stale or moved evidence pins in
generated documentation and historical consumer paths are follow-up
maintenance, not runtime blockers.

• Newly monitored message-output consumers were manually inventoried across
  the complete compare.

Resolved issues

Closes #431
Closes #438
Closes #440
Closes #442
Closes #456
Closes #458
Closes #461
Closes #463
Closes #465

Merge contract

Promotion must use Create a merge commit. Never squash or rebase the
persistent next branch into main.

• The resulting commit message has no bot, AI-agent, or automation
  Co-authored-by trailer.
• delete_branch_on_merge is false and remote next exists.
• The main ruleset allows merge commits and does not require linear
  history.
• The next ruleset does not require linear history.

Rollback readiness

• Rollback owner: @ss-o
• Observable rollback criteria:
  • clean installation or startup failure
  • a regression in the ZD integration suites
  • message byte, newline, or file-descriptor regressions
  • archive or directory-snippet containment regressions
  • a scheduler idle-loop regression
• The owner can open a same-repository hotfix-* pull request that reverts
  the promotion merge through protected main.
• The revert pull request will run Guard main branch source and
  Promotion gate.
• After a revert, clean install and startup will be confirmed at the new
  main head, then the hotfix will be merged forward into next.

Never force-push either persistent branch. Roll back with a reviewed revert
commit so the incident and recovery remain auditable.

Stable consumption boundary

Merging this promotion updates the Git-consumed stable main ref. After exact
merge-result verification, the separately approved v2.0.0 signed tag and
GitHub release will publish the breaking milestone with reviewed release notes.