fix: pre-release hardening for locking and the release workflow

[BartoszBlizniak]

Summary

Final hardening pass before tagging v0.1.0. Four fixes:

• install.sh lock-release race: LOCK_DIR was assigned before the mkdir acquisition loop, and the EXIT-trap cleanup unconditionally removed it — so a waiting installer that died (lock-wait timeout, or INT/TERM while waiting) deleted a lock directory owned by another running installer, letting a third installer proceed mid-activation. The lock path is now assigned to the cleanup-tracked variable only after mkdir succeeds, matching the semantics install.ps1 already had; all post-acquisition failure paths still release the lock via the EXIT trap.
• release.yml trigger: restrict the tag trigger from v* to v[0-9]+.[0-9]+.[0-9]+ so a stray v-prefixed tag cannot publish an immutable release and open vendoring PRs.
• release.yml vendor job idempotency: reruns now git push --force-with-lease (with a fetch of the branch ref first, since the clone is single-branch) and skip gh pr create when a PR for the vendoring branch already exists.
• CHANGELOG.md: cut the 0.1.0 release section (dated 2026-07-16), keeping an empty Unreleased heading.

This is the final gate before tagging v0.1.0.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Validation

• bats tests/ — 42/42 pass, including a new regression test ("a waiter that dies does not remove another installer's lock": pre-creates a foreign lock, TERMs the waiting installer, asserts the foreign lock still exists). Verified the new test fails against the pre-fix install.sh and passes after the fix.
• shellcheck --shell=sh --severity=style install.sh — clean
• sh -n, dash -n, bash -n install.sh — clean
• python3 -c "import yaml; yaml.safe_load(...)" on release.yml — valid
• zizmor .github/workflows/release.yml — no findings

Compatibility

None. No changes to supported targets, options, environment variables, installation paths, or the four-line output contract.

Checklist

• I have added or updated tests where appropriate.
• I have updated documentation and CHANGELOG.md where appropriate.
• I have not included credentials, tokens, or other sensitive data.
• I have called out any breaking change explicitly.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Hardens the installer locking semantics and the release workflow ahead of tagging v0.1.0, with a regression test to prevent lock-release races during concurrent installs.

Changes:

• Fix install.sh lock ownership tracking so a waiting installer that exits cannot remove another process’s lock directory.
• Add a Bats regression test covering the “waiter dies” lock scenario.
• Adjust release automation (tag trigger + vendoring job idempotency) and update the changelog for 0.1.0.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/install.bats	Adds a regression test ensuring a terminated lock-waiter does not remove a foreign lock.
install.sh	Delays assigning LOCK_DIR until after lock acquisition to prevent erroneous cleanup by non-owners.
CHANGELOG.md	Updates release headings around 0.1.0 (needs alignment with PR description).
.github/workflows/release.yml	Tightens tag triggering and makes vendoring reruns more idempotent (tag pattern needs correction).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.