feat(bashunit): deprecate legacy runner and migrate catalog tests

Plan

Closes #441.

1. Deprecate bash-unit-tests without removing its compatibility contract.
2. Run all 15 catalog standalone-script consumers through native Bashunit cases, retaining process isolation, verification environments, custom job names and report paths.
3. Verify distinct JUnit identities and actual GitLab ingestion, complete required source CI/documentation and owned teardown before review.

Implemented and verified

• All 15 consumers use Bashunit; deprecated self-tests and public legacy inputs remain unchanged, using the shared deprecation-warning component.
• Subprocess isolation preserves strict failures, continued execution, EXIT cleanup, working directory and filenames with spaces.
• Every standalone script gets a stable native classname/name pair; no report rewriting or suppression.
• All four migration regressions and eight real unit-component checks pass with publisher-checksum-verified Bashunit 0.52.0 and declared isolated Python dependencies.
• All 35 task-scoped file bytes survive the delivered-main rebase unchanged; Bash syntax, final diff and whitespace checks pass.
• Complete required exact-new-source CI, actual migrated reports/documentation and owned teardown.
• Final current-head DoD and guarded review.

Preceding-head acceptance

Complete current-head migration CI succeeds at unchanged 2ffec2d9. Fully paginated recursive inspection, including both workflow connections and the catalog-pipeline connection, covers 67 successful pipeline nodes and 262 jobs: 257 successful jobs and five unchanged declared optional/negative checks. No required job fails, skips or remains unfinished; no node is unread.

Downloaded native JUnit verifies all 80 expected script cases across all 15 migrated wrappers, with 80 distinct classname/name identities, zero failures/errors/skips and no missing or unexpected script. Every expected identity is successfully retained in the actual GitLab test-report API, including all 33 root cases and the original report path. No report is rewritten or suppressed.

All six cleanup jobs succeed. Actual traces verify owned Helm/ZAP release and namespace deletion, both Argo Application removals and successful Molecule destruction; the external Gruyere fixture is explicitly ephemeral. Root documentation and its browser child pass; downloaded rendered deprecation/migration pages are reviewed.

Source fast-forward and current-main rebase are no-ops. The full 35-file diff, identical wrapper bodies, whitespace and every current feedback/discussion page are reviewed. Legacy compatibility, verification environments, strict failures and cleanup remain intact. Final DoD is complete. The guarded helper assigned xrow by the linked-work-item-author rule. The project's automatic Duo service-account notice is not source feedback or approval; its existing reviewer entry is preserved. Decision: ready for human review; keep #441 open until delivery. No approval, merge or CI-policy bypass was attempted.

Shared deprecation component feedback

Implemented the owner-requested shared deprecation component in 1b6450f0, after rebasing onto delivered main 2f68e565. The legacy component now composes checkout-local deprecation-warning, with distinct instance names and matching stage/needs/rules, instead of printing its own warning. Only the shared warning keeps its intentional allowed-failure policy; legacy test failures, environment, JUnit and all migrated wrappers retain their contracts.

The new actual-component regression rejects preceding source and passes both warning instances plus successful/failing legacy executions. All four migration and eight real unit-component checks pass with publisher-checksum-verified Bashunit 0.52.0 and the required isolated Python reporting dependency. Markdown lint, rendered-guide/link readback, Bash syntax and scoped diff/whitespace pass. Exact pushed-source GitLab compilation validates the root and two simultaneous legacy consumers: warning jobs are distinct/allowed-failure, while both test jobs remain required. Existing unconditional-rule duplicate-pipeline warnings remain visible.

Published with an exact previous-source lease and CI skipped. Decision: keep draft/paused, with no reviewers, while default-branch CI is active. Complete amended-source CI/children, native JUnit identity ingestion, documentation build, all owned teardown and final DoD remain required. The owner thread remains unresolved pending actual amended-source verification; preceding-source green CI is not acceptance for this change.

Release/revert main refresh and amended-source CI

Refreshed the shared-deprecation correction onto delivered release/revert main 72eef993 at da381d5e. The complete source tree is byte-identical to preceding 1b6450f0; no implementation or dependency version changed. All four migration regressions and eight real unit-component checks pass using publisher-checksum-verified Bashunit 0.52.0 and isolated declared Python reporting dependencies. Changed-shell syntax and whitespace pass. Published with the exact previous-source lease and CI skipped.

Started complete amended-source MR CI after a complete 79-project/six-status inventory returned zero errors and only the independent Browserless root, followed by fresh project-idle, owner-created membership, assignment, source and feedback guards. The preceding lifecycle is fully settled across 67 successful pipeline nodes and 262 jobs, with no required failure and all six cleanup jobs successful. Actual traces verify owned Helm/ZAP namespaces, both Argo Applications, Molecule destruction and the explicitly ephemeral external fixture; one timed-out child read was recovered before dispatch.

Keep draft/in-progress without reviewers and leave the owner thread unresolved until actual amended-source verification. Required complete CI/children, shared-warning/legacy behavior, all 15 native report identities and GitLab ingestion, documentation, owned teardown and final DoD remain outstanding. No ordinary check, compatibility contract, scanner policy or production resource changed.

Verified shared-deprecation head

The shared-deprecation amendment is fully verified at da381d5e. Complete source CI passes all required jobs and bridges across 67 successful pipeline nodes and 263 inspected jobs: 257 jobs succeed; six declared optional/negative/warning failures remain visible. The added failure is the requested shared deprecation-warning job, intentionally allowed to fail; the production legacy test policy remains unchanged. Its actual trace prints the shared warning and the required legacy JUnit verifier succeeds. The external scanner and report recover through targeted retries without source or policy changes.

Downloaded raw JUnit and GitLab's actual ingestion verify all 80 expected, distinct script identities across all 15 wrappers, with zero failures/errors/skips and no missing or unexpected script. All six cleanup paths are verified with actual removal/destruction traces. Generated legacy, migration and shared-warning documentation pages are read back. One transient YAML-child read was recovered before final acceptance; no node remains unread.

Fresh source fast-forward/current-main rebase is a no-op. The full 35-file scoped diff, identical wrapper bodies, whitespace and every feedback/discussion page are reviewed. Existing legacy inputs, strict failures, verification environments, custom names/report paths and subprocess cleanup remain intact. This addresses the request to reuse the existing deprecation component and completes current-head DoD. Decision: resolve this addressed implementation thread and mark ready for guarded reviewer selection; this is not approval or merge.

Guarded reviewer selection assigns xrow by the linked-work-item-author rule after successful current-head DoD and addressed feedback. Ready for human review; no approval or merge was attempted.