fix(release): close four defects in the owned-soname cross-check

[justinjoy]

Refs #1285. Based on main, independently mergeable.

This does not re-land the extraction. An independent implementation of #1285 merged as
#1299 while my branch sat unpushed. Reviewing that merged version found four defects; this
applies the fixes on top of it. My original branch (#1333) duplicates the extraction and is
closed as superseded.

The four defects, all present on main today

1. The headline assertion produces no diagnostic on the platform it runs.
test-derive-owned-sonames.sh:89 is a bare [[ ]] followed by check $?. Under errexit that
aborts before its own FAIL line, before the expected/got dump, and before any remaining case
executes. Measured with the derivation mutated: exit 1, zero output. The direction is the
worst one — bash 3.2 does not apply errexit there, and tests/meson.build gates this test to
Linux, so the diagnostics are dead exactly where they run.

2. The cross-check re-inlines the classifier it just extracted, ten lines below the call —
the untested, release-only duplicate #1285 exists to remove. And the two disagree: the inline
copy uses -maxdepth 1, so a library installed under a subdirectory of libdir is invisible
to the check whose job is catching libraries the owned set doesn't name.

libdir/sub/libnested.so
  installed (inline, -maxdepth 1):  libwirelog.so, libwirelog.so.0        ← invisible
  installed (derivation):           libnested.so, libwirelog.so, libwirelog.so.0

3. Derivation and comm failures are swallowed. Either yields an empty result that comm
reports as a clean subset, so the cross-check passes having asserted nothing:

old form, derivation fails:  exit 0, missing=''   ← passes having asserted nothing
new form, derivation fails:  exit 1, derivation's own diagnostic on stderr

Empty is not merely tolerable there — it is impossible, since libdir is dirname "$lib"
where $lib was located four lines earlier. The only way to reach it is a real failure.

4. The locale probe is a pipeline under set -o pipefail. Not fixed because the SIGPIPE is
reachable — measured headroom is large — but because it is an if condition, so errexit
doesn't apply: a SIGPIPE would silently take the else branch and print
ok locale (en_US absent, skipped) while dropping both locale assertions. Reporting PASS
while having stopped asserting is what this gate exists to prevent.

Also corrected

• A false rationale in three places. "An empty set would make the closure check vacuous" —
  check-shared-library-closure.sh and run-upgrade-matrix.sh each carry their own -s guard,
  both predating the extraction, and one sits directly below the || exit 1 whose comment
  described an unreachable outcome.
• The Linux gate now records both its reasons. Only the Windows one was written down. The
  macOS reason is that the locale case asserts glibc's punctuation-ignoring collation, which
  Darwin's en_US.UTF-8 is not known to provide — and the candidate loop tries en_US.UTF-8
  precisely because macOS has it, so widening the gate would produce a hard false failure.
  The prerequisite for ever widening it is stated. normalize_root (17 lines of Windows path
  handling) is deleted as unreachable under that gate.
• Two assertions checked only "non-zero", which set -u and the empty-set guard satisfied
  by other routes — they held while pinning nothing they named. Now they assert exit 2
  (usage) and the specific "not a directory" message, and each is killed by its own mutation.

Verified on real GNU bash 3.2.57 as well as 5.3. Local: 314 Ok / 0 Fail.

tests/meson.build carries only the gate-comment change — I copied the whole file first and
caught a 164-line diff that would have silently reverted other merged work.