v0.9.1

macOS hardening — full bash 3.2 compatibility, 538 tests green on both platforms.

Config drift detection, the config command, and all smoke tests were broken on macOS due to GNU-only commands (md5sum, timeout), bash 3.2 empty-array crashes, and BSD sed incompatibilities. Every issue is fixed, and 9 new tests cover the pull-fallback logic, portable hashing, and update behavior.

Fixes

• Config drift on macOS — compute_config_fingerprint used bare md5sum which doesn't exist on macOS. Now uses the portable _md5 wrapper (md5 -q fallback)
• Config command crash on bash 3.2 — ${current_caps[@]} expansion on an empty array triggers "unbound variable" under set -u. Fixed with the safe ${arr[@]+"${arr[@]}"} pattern
• Smoke tests on macOS — timeout command doesn't exist on macOS. Replaced with portable perl -e 'alarm shift @ARGV; exec @ARGV' fallback
• BSD sed compatibility — all sed -i calls in tests now use -i.bak (BSD sed requires a backup extension)
• Smoke _compute_cname — reimplemented inline instead of sourcing the entire CLI (which failed on bash 3.2 due to strict-mode interactions)
• Version box alignment test — replaced locale-dependent awk with bash ${#} for consistent width measurement
• Docker start failure test — mock docker now fails for both start and run, handling macOS CI TTY recovery edge case

Changes

• Portable _md5 helper and _portable_timeout moved to shared test/setup.bash
• CI diagnostic step verifies binary runs on macOS bash 3.2 before test suite
• 538 (+9) behavioral tests (46 docker_commands, 13 helpers, 9 update)
• 20 mutations caught
• All 538 tests green on Linux (bash 5) and macOS (bash 3.2)