safe-bash audit v2: M12 - cut -c silently strips a leading BOM from any line

[kamilio]

Reference: docs/issues/safe-bash-security-audit-v2.md (Medium finding M12)

M12. cut -c silently strips a leading BOM from any line — BOM_CAPTURE fix incomplete at the command layer

text.ts:331 — per-line new TextDecoder() (ignoreBOM:false). The shell-level fix
(shell.ts:304-305, ignoreBOM:true) is intact, but command-internal decoders were left at
default. PoC: 41 0a ef bb bf 42 0a → cut -c 1-2 emits 41 0a 42 (mid-file BOM bytes
deleted); cut -b is correct. Same decoder class (BOM-blind, not byte-corrupting):
search/rg.ts:24, yq/index.ts:389, file/classify.ts:80, html-to-markdown/input.ts:77.
Fix: ignoreBOM:true at text.ts:331 + audit the listed decoders.

[kamilio]

Validated and locally committed the cut -c BOM correction with 79 complete text/BOM regression checks and focused strict types passing. Byte mode and intended BOM policies in the other listed decoders remain unchanged. This is local commit e825424, NOT yet remote delivery; the issue will close immediately after its validated push. Integrating alongside #586 without overlapping file ownership.

[kamilio]

Delivered to origin/main at ed2a6fa; remote SHA verified before this immediate post-push closure. Reproduced the BOM loss before repair; cut character decoding now preserves record-leading BOM characters while retaining byte-mode behavior, UTF-8 replacement, code-point positions, LF/NUL framing, producer ownership, and cancellation. Audited the other listed decoders rather than flipping intentional document-prefix policies. 38 dedicated BOM tests pass; the final merged text/line/sort cohort passes 174/174. Full-input auditing also caught and corrected the new decoder mock's type annotations without changing runtime assertions. Normal full build/npm test, final root/package/workflow lint, and 26 current consumer groups pass; byte-exact built-public smoke and screenshot pass. The separate full-source audit still reports 13 historical #605 diagnostics, so that issue remains open. Release publication is monitored separately and is not yet claimed.

[kamilio]

Release follow-up: both workflows for ed2a6fa succeeded. SafeFS/SafeJS/Safe Bash 0.1.83 actually published (run 33929384845); poe-code 14.0.38 actually published (run 33929385007), and registry gitHead matches the delivered commit. Fresh, integrity-verified 0.1.83 tarballs passed Node/Bun/TypeScript/browser-bundle checks and the public BOM, fragmented-sort/head, and quota-alias regressions. Browser output was exercised under Node, not a deployed browser or live remote provider. Issue closure preceded release monitoring, as requested.