fix(shell): preserve pipeline verdict semantics

docs/scratchpads/1099-pipefail-sweep.md

@@ -9,7 +9,7 @@
 
 ## Tranche 1 TDD
 
-RED-first control: `node --test scripts/pipefail-early-exit.test.mjs` reported 28 non-accepted runtime/general sites, including `install.sh:312`, and exited 1. The same control is green after construction changes. It also inventories accepted sites rather than silently excluding whole files.
+RED-first control: `node --test scripts/pipefail-early-exit.test.mjs` reported exactly 26 non-accepted runtime/general sites, including `install.sh:312`, and exited 1. A checked-in fixture generated from immutable baseline `df4c591a` records all 26 normalized sites; the control passes every fixture entry through the same scanner, asserts exact identity/count/uniqueness, and separately requires zero findings in the current tree. It also inventories accepted sites rather than silently excluding whole files.
 
 Construction choices:
 
@@ -28,5 +28,6 @@ Site-by-site verdicts: `docs/reports/quality/1099-pipefail-sweep.md`.
 - `test-mutate-push-guard.sh`: 8/8 pass.
 - `test-send-message-verdict.sh`: 3/3 pass.
 - `test-send-message-socket.sh`: pass.
+- Independent review 143 found two semantic regressions: a help-probe `|| true` changed the failure truth table, and an unguarded Git capture changed non-Git data-dir behavior from rc 0 + JSON to silent rc 128. Both received RED-first regressions before correction; help status is now separate and required, and Git status remains condition-guarded.
 - Wake detector/reconcile/digest/preimage suites terminate at their existing fail-closed #973 `BASH_LINENO` environment probe (exit 97, observed `[3 5]`, expected `[3 4]`) before subject tests. No bypass or skip was used; canonical CI remains required.
 - ShellCheck reports only pre-existing source-following, unused-variable, and untouched `ls | head` findings; no new diagnostic was introduced.