fix(audit): use portable grep instead of ripgrep for CI portability

The v0.3.0 tag-push CI run failed on the tag-only 'audit.sh release' step with 'CHANGELOG missing v0.3.0 section' even though the section was present. Root cause: audit.sh used rg (ripgrep) for the CHANGELOG check and 5 other checks, but the GitHub ubuntu-latest runner does not ship rg on PATH; errors were masked by 2>/dev/null, so the release gate failed while audit.sh all's rg-based checks silently false-passed in CI.

Replace all 6 rg calls with portable grep: grep -qF for fixed-string single-file checks (closeout), grep -rq for the two recursive runtime scans, and grep -q for the CHANGELOG regex. Matches the README POSIX-grep portability contract. Confirmed locally by shadowing rg with a not-found stub: release now passes and all passes end-to-end.

Author: Cipher-85

.opencode/audit.sh

@@ -134,18 +134,18 @@ run_closeout() {
     # Trigger only when the skill declares a closeout marker.
     local has_marker=0 m
     for m in "${markers[@]}"; do
-      if rg -q -F "$m" "$f" 2>/dev/null; then has_marker=1; break; fi
+      if grep -qF "$m" "$f" 2>/dev/null; then has_marker=1; break; fi
     done
     if [ "$has_marker" -eq 0 ]; then
       pass "$s (no closeout marker; skipped)"
       continue
     fi
     local missing=() bad=()
     for m in "${required[@]}"; do
-      if ! rg -q -F "$m" "$f" 2>/dev/null; then missing+=("$m"); fi
+      if ! grep -qF "$m" "$f" 2>/dev/null; then missing+=("$m"); fi
     done
     for m in "${forbidden[@]}"; do
-      if rg -q -F "$m" "$f" 2>/dev/null; then bad+=("$m"); fi
+      if grep -qF "$m" "$f" 2>/dev/null; then bad+=("$m"); fi
     done
     if [ "${#missing[@]}" -eq 0 ] && [ "${#bad[@]}" -eq 0 ]; then
       pass "$s (closeout routing complete)"
@@ -163,13 +163,13 @@ run_runtime() {
   printf '\n── Runtime References ──────────────────────────────────────\n'
   # Check for stale Claude references
   local stale=0
-  if rg -q '\.claude/' "$root"/.opencode/agents/ "$root"/.opencode/skills/ 2>/dev/null; then
+  if grep -rq '\.claude/' "$root"/.opencode/agents/ "$root"/.opencode/skills/ 2>/dev/null; then
     fail "stale .claude/ references in agents/skills"
     stale=1
   else
     pass "no .claude/ references"
   fi
-  if rg -q 'CLAUDE\.md' "$root"/.opencode/agents/ "$root"/.opencode/skills/ 2>/dev/null; then
+  if grep -rq 'CLAUDE\.md' "$root"/.opencode/agents/ "$root"/.opencode/skills/ 2>/dev/null; then
     fail "stale CLAUDE.md references"
     stale=1
   else
@@ -275,7 +275,7 @@ run_release() {
   pass "VERSION: $version"
 
   # Check CHANGELOG has the section
-  if [ -f "$changelog" ] && rg -q "^## v${version}" "$changelog" 2>/dev/null; then
+  if [ -f "$changelog" ] && grep -q "^## v${version}" "$changelog" 2>/dev/null; then
     pass "CHANGELOG has v$version section"
   else
     fail "CHANGELOG missing v$version section"