Establish guarded Base Bash v2 release line

[codeforester]

Summary

• define the clean-break v2.0.0 release line, prerelease identifiers, GA policy, and withdrawn July 2026 release history
• add a fail-closed repository release guard that rejects stable 0.x/1.x releases, binds operations to the canonical manifest, and locks real publication behind the artifact and pre-GA RC gates
• pin source-checkout guidance to the v1.4.0 release commit and require the canonical v2 release asset for Homebrew
• add adversarial BATS coverage plus a pinned Bash 4.2.53 release-guard smoke in CI

Scope

This is the release-line foundation slice of #215. It deliberately leaves VERSION at 1.4.0 and keeps #215 open for the remaining provenance, artifact, tag/ref, and coordinated rollout work.

Validation

• ./tests/validate.sh
• tests/lint-warnings.sh
• bats tests/release.bats
• tests/bash-42-release-smoke.sh
• git diff --check

The local Docker daemon was unavailable; the expanded pinned Bash 4.2.53 GitHub Actions job provides the exact lower-bound execution.

Refs #215