build(ci): make dugite-check — track dugite-native upstream for security (T-88)

D-59 requires tracking dugite-native (bundled git) releases for security
updates, but it lived only in the D-record prose with no mechanism (clean-house
flagged RULE-SUNSET-WITHOUT-TICKET). Add ci/check_dugite_version.sh + a
`make dugite-check` target: compares the Makefile DUGITE_VERSION pin against the
latest desktop/dugite-native release and loudly flags CVE / security mentions in
the notes. Informational (not a push gate) — the bump itself is manual per D-63
and automated by T-25.

The script header is the maintenance home (dugite is fetched, not built, and
native/dugite/ is gitignored, so there's no BUILD.md to record it): cadence
(quarterly / on a git CVE), advisory subscriptions, and the bump procedure.
D-59's cost line + a Makefile comment now point at the mechanism. T-88 stays
open as the recurring calendar; first check (2026-06-28) shows v2.53.0-3 current.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci/check_dugite_version.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# T-88 — track dugite-native (bundled git) upstream releases for security
+# updates (D-59). Compares the pinned DUGITE_VERSION against the latest
+# desktop/dugite-native release and flags CVE / security mentions.
+#
+# WHY THIS SCRIPT IS THE MAINTENANCE HOME: dugite's binary is FETCHED at build
+# time (`make dugite-fetch`), not built, and native/dugite/ is gitignored — so
+# there is no `native/dugite/BUILD.md` (D-63) to record it. The pin lives in the
+# Makefile (DUGITE_VERSION / DUGITE_COMMIT); this script + its `make dugite-check`
+# target are the version-tracking calendar D-59 requires.
+#
+# CADENCE: run quarterly during normal operation. Run IMMEDIATELY on a git or
+# dugite-native security advisory — subscribe to:
+#   https://github.com/git/git/security/advisories
+#   https://github.com/desktop/dugite-native/security/advisories
+#
+# This check is INFORMATIONAL (not a push gate): it reports drift and flags CVE
+# mentions. The bump itself is manual per D-63 (reproducibility record) and is
+# automated by T-25 (CI). A bump updates: Makefile DUGITE_VERSION/COMMIT, the
+# fetched binary in native/dugite/, and assets/licenses.yaml if the bundled git
+# or dugite version changed.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REPO="desktop/dugite-native"
+CURRENT="$(grep -E '^DUGITE_VERSION[[:space:]]*:=' Makefile | head -1 | sed -E 's/.*:=[[:space:]]*//')"
+
+# Public read — no auth needed for a quarterly check. gh would raise the rate
+# limit but isn't required; curl keeps this dependency-free.
+json="$(curl -fsSL -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null || true)"
+LATEST="$(printf '%s' "$json" | sed -nE 's/.*"tag_name":[[:space:]]*"([^"]+)".*/\1/p' | head -1)"
+
+if [[ -z "$LATEST" ]]; then
+  echo "==> dugite-check: couldn't reach the dugite-native releases API." >&2
+  echo "    Check manually: https://github.com/$REPO/releases" >&2
+  exit 2
+fi
+
+echo "==> dugite-check (T-88): bundled '$CURRENT' vs latest release '$LATEST'"
+if [[ "$CURRENT" == "$LATEST" ]]; then
+  echo "    OK — up to date."
+else
+  echo "    DRIFT — a newer dugite-native release exists:  $CURRENT -> $LATEST"
+  echo "    Bump (D-63 record; machine: T-25): update Makefile DUGITE_VERSION/COMMIT,"
+  echo "    refresh native/dugite/, and assets/licenses.yaml if the git/dugite version changed."
+fi
+
+# Loud flag when the latest release notes mention a CVE / security fix — those
+# jump the queue regardless of the quarterly cadence.
+if printf '%s' "$json" | grep -qiE 'cve-[0-9]{4}|security (fix|advisory|release|update)|vulnerab'; then
+  echo "    !! SECURITY: the latest release notes mention a CVE / security fix — schedule a bump NOW." >&2
+fi