CHORE: config/SSOT drift — dead version pins, eza latest-URL, stale comments, commit-msg hook, CRLF

[mlorentedev]

Severity: Low/Med · Proposed priority: P3 · Audit IDs: C17, C18, C30, C33, C12, C42, C39, C38

A cluster of small config/SSOT drift + a few trivial one-liners. Split into sub-tasks if preferred.

• C17 — dead version pins. versions.conf:16-18 OBSIDIAN_VERSION/EZA_VERSION/ZOXIDE_VERSION have zero consumers repo-wide; the header claims "the Windows CI downloads" eza/zoxide but .github/ has no such download. Delete or wire them.
• C18 — eza installed from a latest/ URL. setup-linux.sh:214 uses releases/latest/download/…, ignoring the pin and reusing the latest-URL rot pattern the repo's own lesson (and fix(setup): repair shellcheck install — versioned asset URL + fail-loud curl #648) condemns. Pin it.
• C30 — stale _comment refs. env-contract.json:2,7 (and cli/README.md:43, session-start-config.json:14, ai/opencode/opencode.jsonc:38) cite deleted doctor.{sh,ps1}/healthcheck.*/load-secrets.*.
• C33 — PR template gates on an abolished artifact. .github/pull_request_template.md:11 still requires a vault 11-tasks.md entry that ADR-018 + refactor(spec): init-spec work-gate is an open GitHub issue (ADR-018) #311 abolished.
• C12 — commit-msg hook rejects the repo's own convention. .github/hooks/validate-commit-msg.sh:5 ^[a-z]+: .+ rejects scoped Conventional Commits (feat(cli):), yet the live history is scoped. tests/validate-commit-msg.bats:21 tests only the unscoped case. Fix regex to ^[a-z]+(\([a-z0-9-]+\))?: .+ (relates to Add a conventional-commit PR-title gate so release-please can't be silently starved #589).
• C42 — .gitconfig Linux path on Windows. helper = !/usr/bin/gh auth git-credential deployed verbatim breaks HTTPS auth in Git-for-Windows. Use !gh auth git-credential.
• C39 — unguarded oh-my-zsh source. .zshrc:13 source $ZSH/oh-my-zsh.sh with no [ -f ] guard and no installer → error on every zsh start on a fresh box.
• C38 — CRLF-in-worktree. 12 tracked *.sh/.gitconfig files show w/crlf under git ls-files --eol despite eol=lf; they break under bash on \r while git status stays clean. Re-normalize + add a dotf doctor guard (incident → guard).

Source: docs/audits/codebase-audit-2026-07-06.md (C17, C18, C30, C33, C12, C42, C39, C38).

[mlorentedev]

Process-audit adds a CONFIRMED repro for the CRLF item (docs/audits/process-audit-2026-07-07.md §4 P11): .gitattributes normalizes *.sh/*.bash/*.zsh/*.bats but the extensionless rc files (.bashrc, .zshrc, .profile, .{bash,zsh}rc.local.example) fall to text=auto → git ls-files --eol shows i/lf w/crlf on Windows checkouts. Effect reproduced: integration image built from a Windows working tree → verify-setup.bats test 42 fails (syntax error near unexpected token 'in\r' in the deployed .bashrc). Note the guard test can only ever run on LF checkouts in CI — it cannot catch the case it guards. Fix: explicit eol=lf lines for the rc files + renormalize + a CI grep for CR in shell-sourced files.

[mlorentedev]

Two more tail items from the codebase audit (docs/audits/codebase-audit-2026-07-06.md) to fold in here:

• C28 — setup-linux.sh:1405 installs the vault-maintenance cron keyed on the script name (crontab -l | grep -q vault-maintenance-weekly). If the checkout path moves, the stale absolute-path cron still matches the grep and is never rewritten → cron execs a dead path. The Windows task (setup-windows.ps1:1906) self-heals on arg-diff; the Linux cron does not.
• C44 (PLAUSIBLE) — cli/internal/secrets/render.go:90 substitutes a secret verbatim into JSON via strings.ReplaceAll; a value containing " or \ would corrupt opencode.jsonc/models.json. stripNewlines only removes CR/LF. Low-probability (API keys rarely contain those) but unguarded — JSON-encode the value for JSON targets.