Sprint 1: Security hardening — fixes, dependency checks, CI

[cluster2600]

Summary

Sprint 1 security hardening pass on ALBATOR macOS hardening scripts. Addresses issue #2 ('vibe coded & broken?') with comprehensive fixes across permissions, static analysis, dependency guards, and CI infrastructure.

What

• Added check_dependencies() guard to 4 core scripts (app_security.sh, encryption.sh, privacy.sh, reporting.sh)
• Fixed SC2155 shellcheck warning in log() function (separate declare and assign)
• Fixed executable permission on tests/test_security.sh
• All 14 .sh files now pass shellcheck -S error and bash -n
• CI pipeline: .github/workflows/core-tests.yml runs shellcheck + syntax check on every push
• macOS 26.x (Tahoe) compatibility verified
• GitHub Releases workflow added for binary distribution
• Doctor diagnostics subsystem (--doctor flag)
• Fallback modes defined for non-critical hardening steps

Why

Issue #2 reported that scripts were 'vibe coded & broken' — missing +x permissions, syntax errors, no dependency guards before critical commands like fdesetup, spctl, diskutil. Without guards, these commands fail silently or with cryptic errors on systems with non-standard configurations.

How

Manually audited each of the 14 shell scripts:

1. Checked and fixed executable bit where missing
2. Added guard functions verifying required binaries exist before use
3. Fixed all shellcheck warnings at the -S error severity level
4. Added CI pipeline to prevent regressions
5. Documented all changes in docs/SPRINT1_SUMMARY.md and docs/2026-02-18-improvements.md

Testing

find . -name '*.sh' -exec bash -n {} \;          # syntax check — all pass
shellcheck -S error $(find . -name '*.sh')       # static analysis — all pass

CI now runs these on every push automatically.

Checklist

• All .sh files pass shellcheck -S error
• All .sh files pass bash -n syntax check
• CI pipeline runs on every push and PR
• Issue vibe coded & broken? #2 addressed and closed
• Dependency guards prevent silent failures
• No breaking changes to existing functionality
• Sprint 1 summary documented in docs/SPRINT1_SUMMARY.md