Extend native OS coverage for paths, descriptors, and CLI exec #20

Goal

Extend native Windows, macOS, and Linux coverage for path handling, descriptors, non-Linux fallback, and trusted-executable CLI checks, including the critical test skips.

Observations

• The portable runner removed a Windows glob literal, but native path behavior is not fully covered.
• Platform-specific declared skips are reported under B01; this unit addresses the critical skips.
• A skipped critical case must not read as green; non-Linux fallback paths need explicit coverage.

Decision gate

Approve the list of skipped critical cases to convert before adding native runs.

Acceptance criteria

• Path, descriptor, and non-Linux fallback behavior has native coverage per declared OS.
• CLI exec validates the trusted executable and fails closed on mismatch.
• Critical skips are converted or reported as unsupported, never false green.

Verification

• Native matrix run -> declared OS cases pass; no critical case remains silently skipped.
• Trusted-exe negative test -> a non-matching executable is rejected.

Release checkpoint

Remaining risk: native runners may be unavailable in some contexts; unavailability is reported, not hidden.

Tracking

Roadmap item: B03-02. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Declare the Node, gh, and OS support policy #19 (B03-01).