fix(exam): cross-platform fallback for the labelling/replay harness

[Munawarx]

Summary

scripts/label-corpus.js hard-threw on non-Linux hosts (race-safe exam I/O requires Linux /proc/self/fd and O_NOFOLLOW), blocking contributors on macOS/Windows from running or developing the exam/replay harness locally. This adds a best-effort cross-platform fallback that preserves symlink-component rejection (not race-safe) so the harness runs off-Linux for development, while the Linux race-safe path is unchanged and remains the authoritative release-gating run.

Changes

• scripts/label-corpus.js: openAnchoredDirectory branches on platform — Linux keeps the /proc/self/fd + O_NOFOLLOW race-safe path; other platforms use path.resolve + statSync symlink checks (returning a marker so readRegularNoFollow/writePrivate use normal paths and skip fd closes).
• docs/REPLAY.md: add a Platform support section stating Linux is authoritative, off-Linux is best-effort dev-only.

Why

• Widens the contributor base (you, Captain, are on Windows — this is the exact blocker our PR docs: document the Linux-only requirement for the exam/replay harness #6 documented).
• Keeps the security property intact: the race-safe path is untouched; only a clearly-labelled, non-race-safe fallback is added for non-Linux.

Verification

• node -e "require('./scripts/label-corpus.js').openAnchoredDirectory(process.cwd())" → no longer throws on win32 (returns {__crossPlatformDir: ...}).
• Linux path is byte-for-byte the original race-safe logic; CI remains ubuntu-latest so the gating exam is unaffected.
• No router / contract-engine / schema / security-boundary changes.

Trade-offs

• The off-Linux path is not race-safe (a TOCTOU window exists). This is acceptable because it is dev-only and explicitly documented; the release-gating run is Linux. If the maintainer prefers, the alternative is to keep the hard throw and rely on containers — but that excludes native Windows/macOS contributors.

Files

• scripts/label-corpus.js
• docs/REPLAY.md

Co-Authored-By: Hermes Agent noreply@hermes.ai

[Munawarx]

Tracking our current contribution set for Leadline (Munawarx). All are independent, each on its own branch:

• fix(router): add deterministic current-state runtime tells (issue #10) #12 fix(router): deterministic current-state runtime tells — closes issue Router: natural phrasings of the core question class are missed (1 of 5 on real prompts) #10 direction docs: contribution rules + security policy #2 (4/5 → 5/5 natural phrasings route). RED test + bench before/after included.
• refactor(receipts): remove dead createClaimSupportReceipt helper #13 refactor(receipts): remove dead createClaimSupportReceipt helper — dead-code cleanup, 44/44 suite green.
• docs(install): document local clone+link flow and CI install smoke #14 docs(install): document local clone+link flow + CI install-smoke — interim install path until npm publish.
• fix(exam): cross-platform fallback for the labelling/replay harness #15 fix(exam): cross-platform fallback for the labelling/replay harness — extends docs: document the Linux-only requirement for the exam/replay harness #6; best-effort (not race-safe) off-Linux, Linux path unchanged.
• feat(router): project-registerable component nouns (issue #10 dir #3) #17 feat(router): project-registerable component nouns — issue Router: natural phrasings of the core question class are missed (1 of 5 on real prompts) #10 direction docs: link CONTRIBUTING and SECURITY from README #3; design pre-posted as feat(router): project-registerable component nouns (issue #10 direction #3) #16 (core-surface, per CONTRIBUTING).
• docs: document the Linux-only requirement for the exam/replay harness #6 docs: Linux-only exam requirement (still open from earlier).

Each PR is self-contained and ready to review independently. Happy to split, adjust, or rebase any of them. Co-Authored-By: Hermes Agent noreply@hermes.ai