fix(wake): #912 exercise the digest/HMAC trust suite in real CI (fix runner divergence + openssl + hard-require) (#921)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/digest.sh

@@ -88,16 +88,37 @@ EOF
 # _scrub_ctrl (stdin) — strip ANSI escape sequences, Unicode bidi controls,
 # zero-width characters, and C0/C1 control bytes. Byte-exact under LC_ALL=C so a
 # multibyte control sequence cannot slip through a locale-dependent class.
+#
+# PORTABILITY (#912): the byte patterns are LITERAL bytes (materialized via
+# `printf %b`), NOT GNU-sed `\xNN` hex escapes. `\xNN` is a GNU-sed extension;
+# BusyBox sed (the Alpine/musl CI runner, running as root) REJECTS a `\xNN`
+# character range with "bad regex ... Invalid character range", which aborted
+# the whole sed and silently VOIDED the scrub in CI — the digest suite's D1/D4/
+# D5/D6 all failed only in the Woodpecker runner because every scrubbed value
+# collapsed to empty. Literal bytes match identically under GNU sed (glibc dev)
+# and BusyBox sed (Alpine CI): a wake digest must render byte-for-byte the same
+# regardless of the runner's sed implementation. LC_ALL=C keeps every match
+# byte-exact (no locale-dependent multibyte class).
 _scrub_ctrl() {
+  local ESC p280 p281 aa ae a6 a9 x8b x8f a0 bom alm
+  ESC="$(printf '%b' '\x1b')"     # U+001B ESC
+  p280="$(printf '%b' '\xe2\x80')" # UTF-8 lead bytes for U+2000..U+203F
+  p281="$(printf '%b' '\xe2\x81')" # UTF-8 lead bytes for U+2040..U+207F
+  aa="$(printf '%b' '\xaa')"; ae="$(printf '%b' '\xae')"   # U+202A..U+202E bidi
+  a6="$(printf '%b' '\xa6')"; a9="$(printf '%b' '\xa9')"   # U+2066..U+2069 isolates
+  x8b="$(printf '%b' '\x8b')"; x8f="$(printf '%b' '\x8f')" # U+200B..U+200F zero-width
+  a0="$(printf '%b' '\xa0')"                               # U+2060 word joiner
+  bom="$(printf '%b' '\xef\xbb\xbf')"                      # U+FEFF BOM/ZWNBSP
+  alm="$(printf '%b' '\xd8\x9c')"                          # U+061C arabic letter mark
   LC_ALL=C sed -E \
-    -e 's/\x1b\[[0-9;?]*[ -/]*[@-~]//g' \
-    -e 's/\x1b[@-Z\\-_]//g' \
-    -e 's/\xe2\x80[\xaa-\xae]//g' \
-    -e 's/\xe2\x81[\xa6-\xa9]//g' \
-    -e 's/\xe2\x80[\x8b-\x8f]//g' \
-    -e 's/\xe2\x81\xa0//g' \
-    -e 's/\xef\xbb\xbf//g' \
-    -e 's/\xd8\x9c//g' |
+    -e 's/'"$ESC"'\[[0-9;?]*[ -/]*[@-~]//g' \
+    -e 's/'"$ESC"'[@-Z\\-_]//g' \
+    -e 's/'"$p280"'['"$aa"'-'"$ae"']//g' \
+    -e 's/'"$p281"'['"$a6"'-'"$a9"']//g' \
+    -e 's/'"$p280"'['"$x8b"'-'"$x8f"']//g' \
+    -e 's/'"$p281$a0"'//g' \
+    -e 's/'"$bom"'//g' \
+    -e 's/'"$alm"'//g' |
     LC_ALL=C tr -d '\000-\010\013\014\016-\037\177'
 }