build(ci): make dugite-check — track dugite-native upstream for security (T-88)

D-59 requires tracking dugite-native (bundled git) releases for security
updates, but it lived only in the D-record prose with no mechanism (clean-house
flagged RULE-SUNSET-WITHOUT-TICKET). Add ci/check_dugite_version.sh + a
`make dugite-check` target: compares the Makefile DUGITE_VERSION pin against the
latest desktop/dugite-native release and loudly flags CVE / security mentions in
the notes. Informational (not a push gate) — the bump itself is manual per D-63
and automated by T-25.

The script header is the maintenance home (dugite is fetched, not built, and
native/dugite/ is gitignored, so there's no BUILD.md to record it): cadence
(quarterly / on a git CVE), advisory subscriptions, and the bump procedure.
D-59's cost line + a Makefile comment now point at the mechanism. T-88 stays
open as the recurring calendar; first check (2026-06-28) shows v2.53.0-3 current.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -264,6 +264,8 @@ else ifeq ($(FLUTTER_OS),macos)
 endif
 
 # -- dugite-native (bundled git) ------------------------------------------
+# Security tracking (D-59): run `make dugite-check` quarterly, or on a git CVE,
+# to compare this pin against the latest upstream release. T-88 is the calendar.
 
 DUGITE_VERSION := v2.53.0-3
 DUGITE_COMMIT  := f49d009
@@ -330,6 +332,10 @@ clide-cli-clean: ## Remove the compiled C `clide` client.
 security: ## Supply-chain gate — osv-scanner over pubspec.lock (CI PR-merge pipeline; run locally on demand). Fails on a known advisory.
 	ci/osv_scan.sh
 
+.PHONY: dugite-check
+dugite-check: ## Track dugite-native (bundled git) upstream releases for security drift (T-88 / D-59). Run quarterly, or on a git CVE. Informational, not a gate.
+	ci/check_dugite_version.sh
+
 # -- pre-push gate --------------------------------------------------------
 
 .PHONY: decisions-validate