fix(portability): replace bash 4 builtins absent from macOS bash 3.2

macOS ships bash 3.2 as /bin/bash, which `#!/usr/bin/env bash` resolves to
when no newer bash is on PATH. Two builtins the repo relies on do not exist
there, and both failed SILENTLY:

- `mapfile` in the three surgical-commit helpers left every array empty, so
  the scope guards passed on nothing (fail-OPEN) and the commits degraded to
  "nothing pending — no-op" while reporting success. deploy-commit.test.sh
  went 4/16; memory and doc commits simply never happened.
- `declare -A` in the session-start hook errored on every session and left
  each plugin cost at 0, so the passive-budget warning could never fire.

`_read_lines_into` is the portable equivalent of `mapfile`, space-safe and
resetting its target first — expanding a never-assigned array trips `set -u`
on bash < 4.4, which is how the empty arrays surfaced as "unbound variable".
Plugin costs move to a `case`.

source-scope.sh's header prescribed `mapfile` to its callers; it now shows
the read loop, and its own test plus run-reconcile.sh stop using the builtin.

deploy-commit 16/16, source-scope 34/34, run-reconcile 25 GREEN / 0 RED,
session-start stderr empty.

lib/tests/source-scope.test.sh

@@ -45,8 +45,10 @@ case "$G" in *"*"*) check C2-grep-has-no-glob "has-glob" ok ;;
   *) check C2-grep-has-no-glob ok ok ;; esac
 
 # --- findargs: one token per line, 3 tokens per dir ---
-N="$(cd "$TMP/plain" && bash "$S" findargs | wc -l)"
-D="$(cd "$TMP/plain" && bash "$S" list | wc -l)"
+# BSD wc -l pads its count with leading spaces, GNU does not — strip them
+# or the string compare below fails on macOS with got[      48] want[48].
+N="$(cd "$TMP/plain" && bash "$S" findargs | wc -l | tr -d ' ')"
+D="$(cd "$TMP/plain" && bash "$S" list | wc -l | tr -d ' ')"
 check D1-findargs-3-tokens-per-dir "$N" "$((D * 3))"
 check D2-findargs-first-token "$(cd "$TMP/plain" && bash "$S" findargs | head -1)" '!'
 
@@ -58,12 +60,14 @@ W="$TMP/work"; mkdir -p "$W/src" "$W/dist" "$W/public" "$W/node_modules"
 : > "$W/src/a.png"; : > "$W/dist/a.png"; : > "$W/public/favicon.ico"
 : > "$W/node_modules/dep.png"
 cd "$W" || exit 1
-mapfile -t FEXCL < <(bash "$S" findargs)
+# bash 3.2 (macOS /bin/bash) has no mapfile — read the lines explicitly.
+FEXCL=(); while IFS= read -r _tok; do FEXCL+=("$_tok"); done \
+  < <(bash "$S" findargs)
 check E1-excludes-dist  "$(find . "${FEXCL[@]}" -name 'a.png' | grep -c '/dist/')"  0
 check E2-keeps-src      "$(find . "${FEXCL[@]}" -name 'a.png' | grep -c '/src/')"   1
 check E3-excludes-nodem "$(find . "${FEXCL[@]}" -name '*.png' | grep -c 'node_modules')" 0
 # public/ survives: the audit's own resource checks live there
-check E4-keeps-public   "$(find . "${FEXCL[@]}" -name 'favicon.ico' | wc -l)" 1
+check E4-keeps-public   "$(find . "${FEXCL[@]}" -name 'favicon.ico' | wc -l | tr -d ' ')" 1
 cd / || exit 1
 
 # --- usage ---