v4.39.2 — CI secret-scan waiver: silent abort on waived last file

Highlights

• The changed-config secret scan no longer dies silently on a waived last file. Field
  report (2026-09-04, Accenture/mercury-composable PR #318 — the first PR ever to
  exercise a .agent/secret-scan-ignore waiver entry in that repo): whenever the
  push/PR's changed-file list ended with a waived credential-class config file, the
  memory check failed in seconds with a hard, outputless exit 1 — no findings, no
  warning, no "skipping", nothing.
• Root cause: a shell-semantics class, not a scanner bug. The exemption filter's loop
  body ended in [ "$keep" = "1" ] && printf .... For a waived trailing file the false
  test becomes the loop's exit status → the command substitution's status → the
  assignment's status — and under the runner's set -e, a failing assignment aborts
  the step before it prints a byte. A false if condition is exempt from -e, so the fix
  is one line: if [ "$keep" = "1" ]; then printf ...; fi.
• Why it mattered: the waiver file is the floor's own recommended escape for
  JSON/.properties fixtures that can't carry the inline lint:allow-secret-material
  tag — so the failure fired preferentially on a team's first legitimate use of the
  feature, looking like CI flakiness rather than a bug.

What's changed

• All three forge floors carried the identical loop; all three fixed, with a comment
  pinning the reason: .github/workflows/agent-memory.yml,
  templates/.gitlab/agent-memory-ci.yml, templates/.azuredevops/agent-memory-ci.yml.
• Class sweep (per the field report's audit request): the pre-commit 50- secret-guard
  fragment already uses the safe if/else form; no other shipped shell ends a
  -e-governed loop/substitution with a bare test-and-act.
• New tests/test_ci_secret_scan_waiver.sh: a static idiom guard on all three floors
  (any bash), plus behavioral cases that extract each floor's filter loop verbatim
  and run it under set -e against the motivating fixture and three neighbors
  (last-file-waived, last-file-not-waived, both orderings of a waived+unwaived pair) —
  red-verified against the pre-fix idiom, green 4 × 3 under bash 5.2.
• Lockstep: VERSION 4.39.2, CHANGELOG.md, UPGRADE.md ladder row +
  4.39.1 → 4.39.2 rung, README release row.
• No shape, protocol, or script-contract change.

Upgrading an enabled repo

Nothing to schedule: this is a plain re-copy of the repo's forge CI floor (verbatim
rows), which the next reconcile performs automatically — no semantic step, no adapter
re-sync, no migration. A downstream interim fix (e.g. mercury-composable f8eb051a)
converges to zero diff on re-copy. Say "AI enable this repo" whenever convenient, or
let it ride along with the next upgrade that touches the repo anyway.

Full details

• CHANGELOG.md — Version 4.39.2
• UPGRADE.md — the 4.39.1 → 4.39.2 rung