chore(memory): correct BLK-022 — gitflow-test.sh is flaky, the before/after was noise

I recorded "92/14 on pristine develop vs 93/13 after — nothing worsened, one
case better". Three consecutive runs on one unchanged tree give 90/16, 92/14,
92/14: the suite is non-deterministic and both figures were single samples of
that spread. The port is indistinguishable from the noise; claiming an
improvement was false precision.

Surfaced because the post-merge run reported 90/16 and looked like a
regression. It was not — but the only reason the question could be settled
was re-running, which is exactly what the original claim had skipped.

.claude/memory/blockers.md

@@ -265,5 +265,5 @@ rules:
   - GNU `sed -i` x3 in `install-plugins.sh` → BSD sed errors → aborts the installer under `set -euo pipefail`.
   - Test-side GNU-isms: `touch -d`, BSD `wc -l` padding (`got[      48] want[48]`), `/bin/grep` (does not exist on macOS), `stat -c`, `sed -i` + `\n` in the replacement.
 - **Solution**: `_read_lines_into` (portable mapfile), `shopt -s nocasematch` (bash 3.1+, keeps the no-fork property), `case` for plugin costs, resolved timeout binary + pure-bash fallback, `_sed_inplace` + awk. Split over 5 branches.
-- **Status**: resolved. Every suite 0 failures except `gitflow-test.sh` (13 failures, PRE-EXISTING and unattributed: 92/14 on pristine develop vs 93/13 after — nothing worsened, one case better). shellcheck 1 finding before and after (pre-existing SC2016).
+- **Status**: resolved. Every suite 0 failures except `gitflow-test.sh`, which is FLAKY: three consecutive runs on one unchanged tree gave 90/16, 92/14, 92/14. Its failures are pre-existing and unattributed, and this port is not distinguishable from that noise — an earlier "92/14 pristine vs 93/13 after, one case better" reading was false precision, comparing two single samples of a non-deterministic suite. shellcheck 1 finding before and after (pre-existing SC2016).
 - **Bonus found while porting**: the orphan-comment cleanup `{N; /^\n$/d;}` in `install-plugins.sh` was a no-op on EVERY platform — after `N` the pattern space starts with '#', so the `^\n$` anchor pair never applied. Rewritten in awk and tested.

.claude/memory/journal.md

@@ -465,4 +465,4 @@ rules:
 - macOS port of the fork, on develop (repo moved from `/home/bchanot-ubuntu/…`; origin switched to git.bchanot.fr/bmottin/claude_mac). Root of everything: `/bin/bash` is 3.2.57 and `#!/usr/bin/env bash` resolves to it. Six defect classes, all SILENT ([[BLK-022]]) — worst is `${1,,}` turning `lib/url-guard.sh` into a pass-through for localhost/127.x/10.x/192.168.x/169.254.169.254 (SSRF guard fail-OPEN); then `mapfile` making the 3 commit guards fail-open + commits silent no-ops, `declare -A` zeroing the budget warning, missing `timeout` making EVERY gate criterion NOT-MET, GNU `sed -i` aborting the installer.
 - gstack Chromium hang = [[BLK-021]]: PW 1.58.2 deadlocks on Node 26 mid-extraction (39/333 files, ALL threads idle). Proven by a 3-way matrix moving one variable. Fixed by bump to 1.63.0 → Chrome 145 → 153. Installer now bounds that step ([[BDR-088]]). [[BLK-008]]/[[LRN-038]] diagnosis corrected — cause was Node, not the ubuntu24.04 fallback build.
 - 5 branches cut, NOT merged (gitflow human gate): bugfix/url-guard-ssrf-bash32, bugfix/macos-bash32-portability, bugfix/macos-gnu-coreutils, bugfix/macos-installer, chore/sweep-bdr019-makefile. Submodule resynced to develop's pointer (11de390), Playwright bump re-applied locally per [[BDR-029]].
-- Open: `gitflow-test.sh` 13 failures PRE-EXISTING and unattributed (92/14 pristine vs 93/13 after) — separate chantier. gitleaks absent from this machine (installer does not provide it) → T16a + `make scan-secrets` unavailable. Nothing pushed.
+- Open: `gitflow-test.sh` failures PRE-EXISTING, unattributed, and FLAKY (90/16, 92/14, 92/14 on three runs of one unchanged tree) — separate chantier. My earlier "one case better" was noise read as signal. gitleaks absent from this machine (installer does not provide it) → T16a + `make scan-secrets` unavailable. Nothing pushed.

.claude/tasks/TODO.md

@@ -1296,8 +1296,10 @@ Oracle = `make test` du repo: chaque défaut est apparu comme une assertion nomm
       Playwright 1.63.0 réappliqué en local ([[BDR-029]]). `chromium.launch()` OK (Chrome 153).
 - [x] T7 capitalisation — BLK-021/022, LRN-150/151, BDR-088, EVAL-029, journal, index à jour.
 - [ ] MERGE — les 5 branches attendent le gate humain gitflow. Rien n'est poussé.
-- [ ] OUVERT — `gitflow-test.sh` 13 échecs PRÉEXISTANTS et non attribués
-      (92/14 sur develop vierge vs 93/13 après). Chantier distinct, pas un reliquat.
+- [ ] OUVERT — `gitflow-test.sh` échoue de façon INSTABLE: 90/16, 92/14, 92/14 sur
+      trois runs d'un arbre identique. Échecs préexistants, non attribués, et ce
+      portage est indiscernable de ce bruit. Chantier distinct. Corollaire: toute
+      comparaison avant/après sur cette suite exige plusieurs runs, pas un échantillon.
 - [ ] OUVERT — gitleaks absent de la machine, non fourni par l'installeur →
       T16a et `make scan-secrets` indisponibles.
 - [ ] OUVERT — dérive d'index préexistante: blockers BLK-018..020 et learnings