[FabioLeitao]

Summary

• chore(gitignore): benchmark RC v2/v3 grava audit_results_rc_v{2,3}.db na raiz e o .gitignore não cobre — árvore suja trava o selo de gate #2064: audit_results_rc_v{2,3}.db ignored at repo root; test that every relative sqlite_path in tests/config/benchmark-*.yaml is covered by .gitignore.
• [P3][docs] Add deterministic Bash completion for published CLIs #1952: Bash completion for the 8 published CLIs with inventory derived from live --help and an anti-drift test.
• chore: shellcheck em CI + bats hermético seletivo pros 65 scripts bash do repo (zero cobertura hoje) #1926 (part 2): Concrete inventory of the 73 tracked .sh in docs/plans/PLAN_SHELL_SCRIPT_HARDENING (EN+pt_BR); 3 hermetic bats files wired into check-all as an OPTIONAL step.
• deps(cargo): bump pyo3 from 0.29.2 to 0.29.3 in /rust/boar_fast_filter #2045: pyo3 0.29.2 → 0.29.3 in rust/boar_fast_filter/Cargo.lock (same diff as Dependabot PR deps(cargo): bump pyo3 from 0.29.2 to 0.29.3 in /rust/boar_fast_filter #2045); cargo test --locked — 20 passed.

Gate files

No file under .github/workflows/ and none of the tripwire gate files is touched, so no Gate-Change-Approved-By is needed.

Not verified

Full ./scripts/check-all.sh on this branch exited 0 with final line: check-all.sh: OK (pre-commit, pytest, and security scans passed). Tiers observed: gatekeeper-audit OK; shellcheck Passed; optional bats 11/11 Passed; check_case_collisions OK; Rust guard Passed (cargo test 20 passed); plans-stats/hubs OK; Pester 41 passed; pre-commit all hooks Passed; pytest 3223 passed, 80 skipped, 2 deselected, 2 xfailed; security scans Bandit + Zizmor + Gitleaks strict Passed (check-all-security-scans.sh: OK). Not in CI: the bats slice is only in local check-all (optional); wiring into ci.yml would touch a gate file and require operator attestation — #1926 stays open for that acceptance gap.

Closes #2064
Closes #2065
Refs #1952
Refs #1926
Refs #2045

🤖 Generated with Claude Code and https://claude.ai/code/session_0142QEjA7eEFcdXTpcTmcAZk