D-59 requires tracking dugite-native (bundled git) releases for security
updates, but it lived only in the D-record prose with no mechanism (clean-house
flagged RULE-SUNSET-WITHOUT-TICKET). Add ci/check_dugite_version.sh + a
`make dugite-check` target: compares the Makefile DUGITE_VERSION pin against the
latest desktop/dugite-native release and loudly flags CVE / security mentions in
the notes. Informational (not a push gate) — the bump itself is manual per D-63
and automated by T-25.
The script header is the maintenance home (dugite is fetched, not built, and
native/dugite/ is gitignored, so there's no BUILD.md to record it): cadence
(quarterly / on a git CVE), advisory subscriptions, and the bump procedure.
D-59's cost line + a Makefile comment now point at the mechanism. T-88 stays
open as the recurring calendar; first check (2026-06-28) shows v2.53.0-3 current.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jpmschweitzerandClaude Opus 4.8
89b7f99a8d