docs(changelog): macOS portability fix + deferred Linux run under [Unreleased]

CHANGELOG.md

@@ -466,6 +466,26 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
   plugin cache or `claude plugin list`.
 
 ### Fixed
+- **`make test` was red on macOS: the suite and seven scripts assumed a GNU
+  userland.** Under `pipefail`, `cmd | grep -q` lets grep exit at the first
+  match and the producer dies of SIGPIPE (rc 141): `lib/gitflow-test.sh`
+  reported 15 false "merged into" failures and `lib/doc-shape.sh` failed open.
+  `update-all.sh` read the marketplace plugin list with `grep -oP`, which BSD
+  grep rejects, so `make update` updated no marketplace plugin on macOS. The
+  design gate bounded `21st whoami` with `timeout`, absent from the macOS
+  system PATH, and reported READY BUT UNVERIFIED. `lib/gstack-links.sh` relied
+  on `realpath -m`, so its refusal to write into the gstack submodule never
+  fired. Producers are now captured before matching. In-place edits use
+  `sed -i.bak` in tests and a temp-sibling copy on the user's shell profile. The
+  other idioms have portable forms: `tr -d ' '` after `wc -l`, python3 for
+  file modes, `touch -t`, a `realpath -m` emulation that refuses `..`, perl
+  `alarm` for the 15 s bound and `sed -n` token extraction.
+  `lib/design-tool-gate.sh` also looks for `claude` and `21st` under
+  `/opt/homebrew/bin` and no longer trips on an empty array under macOS's bash
+  3.2. A failing `claude plugin enable` no longer aborts `profile set`. New
+  hermetic suite `lib/tests/portability-census.test.sh` flags GNU-only idioms
+  (`sed -i` without suffix, `stat -c`, `realpath -m`, `touch -d`, `grep -P`,
+  bare `/bin/grep`) in tracked shell files.
 - `install-plugins.sh` never offered the ctx7 and 21st logins: both blocks required stdout to be a terminal, and stdout is the `tee` pipe of the install log. They now test stdin alone, as `update-all.sh` already did.
 - `lib/effort-pins.sh` residual LOW (security re-gate of BDR-108): INT/TERM trap removes the mktemp sibling and exits 130 (never an EXIT trap, the installer owns one); the post-write re-read message no longer claims CRLF and is reached by a stubbed unit test; the rejected map line is printed through `printf '%q'` so a caller's `echo -e` cannot interpret map content; the fixture suite guards its `mktemp -d` and skips the read-only case visibly under root.
 - `update-all.sh` re-fetched the vendored skills at every run but never re-applied the effort pins: brainstorming/writing-plans lost their xhigh until the next `make plugin` (BDR-107 gap, closed by `lib/effort-pins.sh`).
@@ -554,6 +574,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
   the plugin while the 7 symlinks are still linked, delete the
   `skills/<7>` symlinks or re-run `make plugin` to avoid duplicate skill
   descriptions.
+- The macOS portability fix has only been run on macOS. Its replacements are
+  meant to behave identically on GNU/Linux, and a Linux `make test` run is due
+  before the next release.
 
 ## [1.5.0] — 2026-09-13