fix(gh-7): use POSIX character class in release.yml sed

[oliver-cieliszak-natterbox]

What

One expression in .github/workflows/release.yml moves from the GNU-only \s shorthand to the POSIX [[:space:]] class, plus a comment explaining why.

Why

PR #2 ("fix: use POSIX character class in sed for macOS compatibility") fixed exactly this pattern, but touched only install.sh - 2 lines, 1 file. The identical expression in release.yml was left behind, so the repo carried two dialects of the same one-liner.

This was not a live bug. That line only ever runs on ubuntu-latest, where GNU sed handles \s correctly, and v0.9.2 through v0.11.0 all passed the version check cleanly.

What makes it worth fixing is how BSD sed fails: not loudly, but silently. It declines to substitute and passes the whole line through, so the check compares the tag against version = "0.11.0" # bump on meaningful config changes; ... and reports a mismatch. Anyone reproducing the release gate locally on a Mac - reasonable, since it is the thing that can block a release - has to work out that their sed is at fault rather than their release. This happened for real while cutting v0.11.0.

How

[[:space:]] is POSIX and behaves identically under GNU sed, so CI behaviour is unchanged.

The comment deliberately spells out "the GNU-only shorthand" in words rather than writing the character pair, so a future grep '\s' .github/workflows/ returns zero hits instead of matching the comment that warns against it.

Test Steps

This line lives in the release gate and only truly executes on a tag push, so it was verified by running the exact expression rather than by cutting a throwaway release:

Check	Result
New expression, BSD sed (local macOS)	0.11.0
New expression, GNU sed semantics	0.11.0
Against every historical distro.toml (v0.9.0 → v0.11.0)	Correct version extracted, both dialects agree, all 6 tags
Full gate simulation, matching tag v0.11.0	Passes
Full gate simulation, mismatched tag v0.99.0	Still blocks - the gate has not been weakened
release.yml parses as YAML	Yes, 4 steps intact, trigger still ['v*']
GNU-only shorthand left in .github/workflows/	None

Old vs new, for the record:

$ grep '^version' distro.toml | sed -E 's/^[^=]+=\s*"([^"]+)".*/\1/'          # old, BSD sed
version = "0.11.0"      # bump on meaningful config changes; major = breaking (requires reinstall)

$ grep '^version' distro.toml | sed -E 's/^[^=]+=[[:space:]]*"([^"]+)".*/\1/'  # new, BSD sed
0.11.0

Other Notes

• Reversibility: two-way door - single expression, no behaviour change on the platform that runs it, trivially revertible.
• The next tag push will exercise this for real. Given the gate still correctly blocks a mismatched tag in simulation and every historical version parses, the risk is about as low as a release-gate change gets - but it is worth a glance at the first run after merge.

Closes #7

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

🛠️ Fix a finding or handle a false positive

• Auto-Fix: Run /orca-pr-scan-fix to automatically remediate or suppress PR findings.
• In-Code: Suppress via inline comments or exception files (see CLI References).
• In Orca: Dismiss or snooze directly via Changing Alert Statuses.