v0.20.5

Fixed

• make check-dev-commands now understands release-swapped trees. The
  second latent release-tree gate failure (after the fuzz-ref-pin one): the
  checker demanded every -dev command twin, which the release prod-swap
  legitimately deletes, so lint failed on every release PR. The checker
  now reads the plugin manifest's name to learn the tree state — dev tree
  (z-spec-dev): twins present and in sync; prod tree (z-spec): zero
  twins allowed, a leftover twin is real drift; any other name fails loud.
  All five states covered by a new regression test.

• Release PRs can pass the all-legs CI gate again. Two structural
  failures surfaced the first time a release ran under the required-legs
  regime: tests/test_fuzz_ref_pin.py hard-listed the generated -dev
  command twins, which the release prod-swap legitimately deletes (it now
  discovers pin sites dynamically, requires the prod trio, and enforces
  exactly one full 40-hex pin per file); and the installer CI legs tried
  to install the release's bumped version from PyPI before the tag
  publishes it (install.sh gained a ZSPEC_LOCAL_WHEEL env seam, and CI
  builds the wheel from the tree under review on release/* PRs — same
  script, only the CLI's download source swapped).

• z-spec's lux menu entries now merge into the same Clients submenu as the
  session's other applets. The applet name stamped the MCP server's own
  process pid; luxd groups Clients-menu entries by the session pid parsed
  from the name, so z-spec always landed in its own orphan submenu (a
  separate "repo (N)" entry per session) instead of joining vox-panel's.
  The name now carries the Claude session pid (the server's parent),
  matching vox-panel. Restart or reconnect z-spec MCP servers to pick the
  fix up. Reported by the lux agent with a precise cross-repo diagnosis.

• CI now proves the software itself — not just the installer — on every
  supported OS. unit, e2e, and specs are matrixed over Ubuntu and
  macOS (previously Ubuntu-only; the test suite had never run on macOS).
  specs downloads the per-OS probcli archive (ProB.macos.zip /
  ProB.linux64.tar.gz) and builds fuzz with per-OS prerequisites.

• The installer matrix gained a TeX dimension (tex: absent | present,
  4 legs). tex=present installs a real TeX distribution (texlive-base /
  BasicTeX) before running install.sh and then requires
  kpsewhich fuzz.sty to succeed — the first CI proof of the
  TEXMFHOME copy + mktexlsr chain, which a bare runner can never
  exercise. tex=absent keeps proving the no-TeX path degrades gracefully.

• CI's specs job now builds fuzz via install.sh's own install_fuzz(),
  not a second, separate build script. The sudo-free installer shipped in
  v0.20.4 had never been exercised by CI or on a genuinely clean machine —
  the specs job built fuzz with its own inline ./configure && make && sudo make install, unrelated to and untested against the new sudo-free
  path. Added install.sh --fuzz-only (build and install fuzz only, no
  CLI/probcli/plugin steps) and pointed CI at it, so a regression in the
  sudo-free build now fails the specs job instead of going unnoticed.
  Verified locally by removing the installed fuzz binary and re-running
  install.sh --fuzz-only from a genuinely clean state — real git clone,
  configure --prefix, make, make install, and TEXMFHOME copy, no sudo,
  no privilege prompt. Also verified against the exact v0.20.4-tagged
  install.sh (before this fix), run end to end as a real curl | sh user
  would — CLI, probcli, and a genuine fresh sudo-free fuzz build all
  succeeded from a clean state.

• CI now runs the whole installer on both Ubuntu and macOS. A new
  installer matrix job runs install.sh --no-plugin end to end on each
  OS — the CLI via uv tool install, probcli via its per-OS archive, and
  the sudo-free fuzz source build — then verifies through the installed
  artifact itself: z-spec doctor, a real type-check, and a real
  model-check. The installer previously had zero automated coverage on
  macOS, the other platform this repo claims to support.