portability lint stage 1: cross-plugin bare-ref gate engine (child of #531)

[kyle-sexton]

Part of #531 — stage 1 of the control-tower planning agent's staged execution plan (see the plan comment on #531 for full context and the member-disposition map). Filed by the control tower per the #603 child-per-stage pattern. STOPGAP NOTE: plain child issue pending the #552 sub-issues convention — convert to a native sub-issue when #552 lands.

Scope

Repo-local orchestrator scripts/check-portability.sh + scripts/check-portability.test.sh, and a new portability-gate job in ci.yml added to ci-status.needs. Load-bearing work: the guard-detection engine (shared by every later stage) — a presence-gated "if installed" reference or one declared in dependencies passes; a bare unguarded cross-plugin / marketplace-internal reference fails. Mirrors check-silent-skips.sh's grep-tripwire-plus-annotated-exemption shape.

Stopgaps sanctioned by the plan (no operator lock needed for this stage): seed tokens inline in the script (external token-list format = OPERATOR DECISION #3 on #531, deferred); site-level escape hatch # portability-ok: <reason> tagged STOPGAP (final name = OPERATOR DECISION #2 on #531); repo-local script placement per the #593 precedent.

Acceptance criteria (lifted from PR #593 / silent-skip precedent)

• Self-test runs FIRST so a broken orchestrator cannot mask a green gate.
• Job never silent-skips — only the inner PR-diff step is event-gated; self-test gives push-to-main a passing path.
• Fail-closed on missing base-ref / missing inputs (exit 2).
• shellcheck --rcfile .shellcheckrc clean; wired into ci-status.needs.
• Does NOT re-detect absolute paths (machine-specific-paths action owns that slice).
• Regression fixtures prove a guarded cross-plugin ref PASSES and a bare one FAILS (honors the toolchain: dotnet.md references dotnet-msbuild:* plugin skills that do not exist in this marketplace #412 disposition — implementation: .NET-only marketplace-skill references in every mode context (origin coupling, low severity) #405/toolchain: dotnet.md references dotnet-msbuild:* plugin skills that do not exist in this marketplace #412 are gate-must-honor, never flagged).

[kyle-sexton]

Control tower (2026-07-20): DO NOT PICK — covered by open PR #609 (T4's portability-lint gate for #531, shipped before this child was filed; the tower's #531 plan and this child were drafted concurrently with that PR in flight). Removing status: ready to prevent double-work. Disposition after #609 merges: close this child as delivered-by-#609 if the merged gate covers the stage-1 scope, else re-scope to the delta.

[kyle-sexton]

Control tower re-scope (2026-07-20, from the #609 merge digest). PR #609 delivers the ENGINE (framework, escape hatches, self-test-first, fail-closed, ci-status wiring) but its active token class is branch-resolution only — the cross-plugin bare-ref class this child owns is neither active nor staged there. This child therefore stays OPEN, re-scoped to: add the cross-plugin token class atop the landed engine — presence-guard vocabulary (if installed / dependencies-declared), bare cross-plugin/marketplace-internal refs FAIL, guarded refs PASS, #405/#412 gate-must-honor fixtures, #422 as the bare-ref fixture. Will flip back to status: ready once PR #609 merges (engine present to build on). Shipped branch-class scope is tracked as sibling child #620.