fix: status judges symlinks sync key, reject TOML-breaking chars, keep exec bits for non-ASCII paths

[min0625]

Three fixes from a full-project review (all reproduced end-to-end before fixing, re-verified after):

1. status omitted the symlinks sync key (spec §4.5)

checkSync (apply / lock --check) compares five sync keys; depStatus compared only four. Changing a dep's symlinks policy without re-locking made status report ok (exit 0) while apply refused with "out of sync" (exit 2) — a CI gate built on status would miss the drift.

Fix: checkSync's field list is extracted into syncFields, the single source of truth now shared by status, so the two can never disagree on what "in sync" means.

2. TOML-breaking characters were never rejected

git allows " in tag names, and the surgical graft.toml editor emits values verbatim inside a TOML basic string. So graft add repo@'v1"x' happily wrote:

version = "v1"x"

…after which every graft command fails with a parse error. version had no character validation at all; repo only rejected whitespace; ValidatePath missed ".

Fix: a shared validateTomlSafe rejects ", \, and control characters in repo, version, subdir, and dir with exit 2 — at load and before graft add writes anything. Spec §7 gains a "write-back (TOML) safety" paragraph (both languages).

3. Exec bits silently dropped for non-ASCII paths

ExecBits parsed ls-tree output with git's default core.quotePath, which octal-escapes non-ASCII paths (腳本.sh → "\350\205\263..."), so the exec bit was recorded under a name that never matches the real file and fell out of the hash. Now runs with -c core.quotePath=off.

⚠️ Hash change: trees containing non-ASCII executable files hash differently after this fix (.graft-execbits content + exec byte). Pre-1.0 breaking change; affected deps need a re-lock. Worth a release-notes line.

Ratchet

docs/requirements.md gains REQ-STATUS-SYMLINKS-SYNC, REQ-TOML-SAFE, and REQ-EXECBIT-QUOTEPATH, each with covering tests (status_test.go, manifest_test.go via TOML literal-string smuggling, add_test.go with a real quoted tag, repocache_test.go). Also refreshes CLAUDE.md's release status (beta.6) and command list.

🤖 Generated with Claude Code

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[codecov]

Codecov Report

❌ Patch coverage is 89.47368% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/gittest/gittest.go	55.55%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!