Backport envy-nx through v1.5.0: aliases_git regex fix

[szymonos]

Summary

Per the BACKPORT.md procedure, surveyed the 15 commits between envy-nx `v1.4.0` (last sync) and `v1.5.0` (`8e23552`, released 2026-05-02). One portable bug fix found:

`fix(sh): aliases_git BSD grep regex empty-alternative incompatibility` (78b177d)

`git_resolve_branch`'s case arms used `(|el|elop|elopment)` empty-alternative patterns. BSD grep on macOS silently fails to match the empty alternative, so `git_resolve_branch ""` and `git_resolve_branch "d"` returned the literal regex pattern instead of resolving to `dev`/`devel`/`development`. Same anti-pattern was lurking in the `gbda` alias.

Replaced with `(el|elop|elopment)?` — unambiguously correct on both GNU and BSD grep. This repo targets Linux only, but having portable shell config means the file stays correct anywhere it ends up sourced.

Caught upstream by envy-nx's integration workflow's full bats suite running on `macos-15`. Ports envy-nx@9da3941.

Skipped (with rationale)

Bucket	Items	Why
Already ported (1)	`Invoke-GhRepoClone` ssh-probe `Get-Command` guard	Landed via #247 (and being removed in #250 alongside the probe itself)
nx CLI / nix-coupled (10)	`nx doctor` evolution (Fix hints, doctor.log, version floor, scope_bins_in_profile), manifest-driven generation (Block D #1, #11), `_io_step` configure-script error reporting, `install_record` flush + bash_version, nix/setup.sh exec-on-refresh	Skip-list — code lives in `nix/` or `.assets/lib/` which we don't have
MITM probe discriminator (1)	`phase_nix_profile_mitm_probe` runs a `curl -k` bypass before mutating ca-custom.crt	Lives in `nix/lib/phases/nix_profile.sh` (the caller of cert_intercept). Our cert_intercept is byte-identical to envy-nx's; this discriminator would need to be added to whatever invokes our cert_intercept (currently nothing automated does). Idea, not direct port — defer
Release / docs / macOS-specific (5)	`make release` improvements (auto-detect VERSION, tag+push, remote-tag pre-check), docs/decisions.md updates, ARCHITECTURE.md sync, project-words.txt, macOS bash 3.2 pin in CI	Skip per playbook (no release tooling, no docs site, no macOS target here)
Test infra deferred (3)	Parallel `run_bats.py` / `run_pester.py` + new `pester_parallel.ps1`, `tests/bats/diagnose.sh` hang-diagnosis, `check-no-tty-read` hook	Suite too small to benefit from parallel runners (~1-2s saving); no `read </dev/tty` patterns exist in our codebase. Revisit if suite grows.

Test plan

• `dash -c '. .assets/config/bash_cfg/aliases_git.sh'` (the POSIX-guard hard-rule check) — sources cleanly
• Functional test of `git_resolve_branch` with stubbed `git` — empty input → dev, `d` → dev, `m` → main, `t` → trunk, `feature/foo` → feature/foo (all correct)
• `make lint` — gremlins / zsh-compat / shfmt / shellcheck / pester / bats all pass
• Linux integration test (`test:integration` label requested)

🤖 Generated with Claude Code