ci: isolate release-artifact tests from dirty worktrees

[codeforester]

Goal

Make the release-artifact BATS tests pass in an ordinary developer checkout without weakening the release command clean-checkout requirement.

Background and evidence

The canonical validation suite was run from base-bash-libs with staged CLI changes. Nine release-artifact tests failed because scripts/release-artifact build correctly rejected the source checkout as dirty with The source checkout must be clean. The failures are in tests 22, 23, and 25 through 31; the remaining 657 BATS assertions passed when stdin was made non-terminal.

The release-artifact script already supports BASE_BASH_RELEASE_SOURCE_ROOT, so the tests can point at a clean detached clone or equivalent clean source fixture while retaining the current checkout as the test runner.

Scope and acceptance criteria

• Make release-artifact build and verification tests use a clean, isolated source root at the tested HEAD.
• Preserve assertions that release artifacts bind to the expected commit and source contents.
• Keep the production repo_is_clean guard intact and continue testing that guard through an explicit dirty-fixture case if coverage is not already present.
• Ensure temporary clones, worktrees, and artifacts are removed by the BATS fixture cleanup path.
• Make the tests work from both clean and dirty developer checkouts.

Validation

• Run bats tests/release-artifact.bats from a dirty checkout.
• Run the full ./tests/validate.sh </dev/null gate.
• Confirm the release command still rejects a deliberately dirty source root.
• Run ShellCheck and git diff --check on the changed files.

Non-goals

No relaxation of release provenance, clean-checkout, artifact verification, checksum, SBOM, or publication policy. No release publication.

Project fields

• Status: Backlog
• Priority: P2
• Area: Product
• Initiative: Adoption Polish
• Size: S

Ownership

• Assignee: @codeforester