fix: preserve spaces in Makefile roots

[garethpaul]

Summary

Preserve absolute iHeartRating Makefile roots that contain spaces and fail closed when untrusted Makefile inputs could replace verification recipes.

Baseline

Master 4d13bc857c3fe32c12cb37e268d913ad2f70cb63 passed the normal static iOS baseline, while absolute Makefile paths containing spaces failed under GNU Make 4.2 and 4.4 before the checker ran. The repository already documented location-independent Make gates and protected ROOT from command-line overrides, but the baseline only asserted the vulnerable expression and did not reject preloaded, overridden, additional, or later replacement Makefiles.

Improvements

• Derive the checkout root from the single loaded repository Makefile while preserving spaces and override semantics.
• Reject nonempty MAKEFILES, command-line MAKEFILE_LIST, multiple loaded Makefiles, and later recipes that attempt to replace check or xcode-test.
• Add a recursive-safe regression from an external directory against a copied checkout whose absolute path contains spaces, including all ambiguity and replacement attacks.
• Strengthen the static baseline to require the helper, fail-closed Make authority contract, synchronized guidance, and completed plan evidence.
• Preserve the existing xcode-test behavior and leave Swift, tests, Xcode projects, podspecs, build script, package boundary, and workflow unchanged.

Validation

• git diff --check
• Python compilation of the baseline and recursive helper.
• GNU Make 4.2 and 4.4: check, lint, test, and build; each recursively passed from a copied space-containing checkout.
• Hostile ROOT=/tmp/hostile-root checks passed under both Make versions.
• Preloaded MAKEFILES, overridden MAKEFILE_LIST, repository Makefile ordering in both directions, and later check/xcode-test recipe replacements failed closed under both Make versions.
• The old root derivation negative control failed the strengthened baseline.
• Two fresh exact-head clones passed strict Git integrity; working, staged, exact-tree, head-ancestry, and two-commit base-to-head gitleaks scans found no secrets.
• Hosted macOS make check and make xcode-test plus CodeQL are required at exact head c464302ff306bc8f7916fb7de2e234e801816a51.

Risk

Low. This changes verification path resolution and Make authority contracts only. The recursive regression adds a small amount of gate runtime. Executable Apple-platform behavior remains covered by the unchanged hosted Xcode gate.

Follow-Ups

No code follow-up is required. Revert commits c464302ff306bc8f7916fb7de2e234e801816a51 and a07451cb7fcd369d4941f4e91398c0208f79e73f if the Make authority hardening needs to be rolled back.