Merge remote-tracking branch 'origin/main' into fix/wake-920-drain-quarantine

# Conflicts:
#	packages/mosaic/framework/tools/wake/manifest.txt

packages/mosaic/framework/tools/wake/manifest.txt

@@ -45,7 +45,19 @@
 #              pointer carries a usable (soft) locator instead of rendering
 #              empty. Display-only: the ACTIONABLE-tier hard-locator FAIL-LOUD
 #              gate (_has_hard_locator, exit 4) is unchanged.
-#   0.6.3  #920 digest.sh drain-quarantine + reconciler-enumeration render tier
+#   0.6.3  #912 digest.sh scrub PORTABILITY (no contract change): _scrub_ctrl's
+#              control/bidi/zero-width byte patterns are now LITERAL bytes (via
+#              printf %b) instead of GNU-sed `\xNN` hex escapes. BusyBox sed (the
+#              Alpine/musl CI runner, running as root) rejects a `\xNN` character
+#              range, which aborted the whole scrub sed and silently VOIDED the
+#              scrub in CI — collapsing every scrubbed value to empty and failing
+#              the digest suite's D1/D4/D5/D6 only in the Woodpecker runner. The
+#              scrub now renders byte-identically under GNU sed (glibc dev) and
+#              BusyBox sed (Alpine CI). The two-tier trust, exit-4 hard-locator
+#              FAIL-LOUD, and the secret-scrub/SHA-preservation contract are all
+#              unchanged — this makes the existing scrub deterministic across
+#              runners, it does not weaken it.
+#   0.6.4  #920 digest.sh drain-quarantine + reconciler-enumeration render tier
 #              (live wake-pilot finding #6, BLOCKING). (a) PER-ENTRY
 #              QUARANTINE: a render-refused ACTIONABLE entry (no §2.1 hard
 #              locator) is now DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl +
@@ -62,9 +74,9 @@
 #              only. reconcile.sh's STORE class is UNCHANGED (non-coalescing), so
 #              distinct enumerations never collapse (§2.3/T2/G3-R6 intact); the
 #              rejected class=digest alternative would have silently coalesced
-#              them. store.sh and reconcile.sh are UNCHANGED by 0.6.3.
+#              them. store.sh and reconcile.sh are UNCHANGED by 0.6.4.
 component=wake
-version=0.6.3
+version=0.6.4
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version