Merge shared CI baseline fixes into external import shadow fix

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/ci/codeql-retrace-vendored.sh

@@ -80,6 +80,8 @@ fi
 printf '%s\n' "$changed" |
     bash "$ROOT/scripts/ci/select-lanes.sh" --codeql-scope c-cpp |
     while IFS= read -r path; do
+        # Native Windows Python writes CRLF; read removes only the LF.
+        path="${path%$'\r'}"
         entrypoints=()
         case "$path" in
         internal/cbm/grammar_*.c | internal/cbm/ts_runtime.c)

tests/test_language_count_contract.sh

@@ -46,14 +46,12 @@ if [[ "$manifest_count" != "$expected" ]]; then
 fi
 
 # --- 3. Every published surface must claim exactly that number. ---
+# The #2729 messaging refresh dropped the count from docs/index.html,
+# docs/llms.txt, pkg/npm/README.md, scripts/package-release.sh and server.json;
+# section 4 below still fails if any of them states a count again unregistered.
 SURFACES=(
     README.md
-    docs/index.html
-    docs/llms.txt
-    pkg/npm/README.md
     pkg/chocolatey/codebase-memory-mcp.nuspec
-    scripts/package-release.sh
-    server.json
 )
 
 # Files that legitimately say "<N> languages" about something OTHER than the

tests/test_select_lanes.sh

@@ -275,6 +275,31 @@ if proc.returncode != 0 or got != ["internal/cbm/grammar_go.c",
                                    "vendored/sqlite3/sqlite3.c"]:
     failures.append(f"codeql (c): the retrace helper must list the translation units for "
                     f"changed vendored code and wrappers, got {got} (exit {proc.returncode})")
+# Native Windows Python emits CRLF even when the change list uses LF. Pin
+# that producer/consumer boundary on every platform, including direct wrapper
+# paths that must survive verbatim rather than being mapped to a family name.
+crlf_root = work / "crlf-selector"
+crlf_scripts = crlf_root / "scripts" / "ci"
+crlf_scripts.mkdir(parents=True)
+(crlf_scripts / retrace.name).write_bytes(retrace.read_bytes())
+expected_retrace = ["internal/cbm/grammar_go.c", "internal/cbm/grammar_json.c",
+                    "internal/cbm/ts_runtime.c", "vendored/sqlite3/sqlite3.c"]
+for path in expected_retrace:
+    fixture = crlf_root / path
+    fixture.parent.mkdir(parents=True, exist_ok=True)
+    fixture.touch()
+(crlf_scripts / "select-lanes.sh").write_bytes(
+    b"#!/usr/bin/env bash\nprintf '%s\\r\\n' "
+    b"internal/cbm/vendored/grammars/go/parser.c internal/cbm/grammar_json.c "
+    b"internal/cbm/ts_runtime.c vendored/sqlite3/sqlite3.c\n")
+proc = subprocess.run([bash, str(crlf_scripts / retrace.name),
+                       "--changed", str(changed), str(listed)],
+                      capture_output=True, text=True, env=env)
+got = listed.read_bytes() if listed.exists() else None
+if proc.returncode != 0 or got != ("\n".join(expected_retrace) + "\n").encode("utf-8"):
+    failures.append(f"codeql CRLF: the retrace helper must preserve every changed "
+                    f"wrapper and write LF entrypoints, got {got!r} (exit {proc.returncode})")
+
 for label, args in (("an unreadable change list", ["--changed", str(work / "missing.txt")]),
                     ("no pull request", [])):
     listed.write_text("stale\n", encoding="utf-8")