release: v0.4.12 — CI credibility + install smoke test

Adds quality.yml CI workflow (shell syntax check by shebang, shellcheck
warn-only), scripts/install-smoke.sh (local smoke covering install dry-run,
syntax check, doctor --json, selftest), and a Proof section in README
listing what is verified end-to-end.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: MCamner

.github/workflows/quality.yml

@@ -0,0 +1,65 @@
+name: Quality
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  shell-lint:
+    name: Shell syntax check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install zsh
+        run: sudo apt-get install -y zsh
+
+      - name: bash -n on install.sh
+        run: bash -n install.sh
+
+      - name: bash -n on release.sh
+        run: bash -n release.sh
+
+      - name: bash -n on scripts/
+        run: |
+          if [ -d scripts ]; then
+            find scripts -name "*.sh" -print0 | xargs -0 -n1 bash -n
+          fi
+
+      - name: Syntax check all .sh files by shebang (exclude backups/)
+        run: |
+          find . \
+            -name "*.sh" \
+            -not -path "./.git/*" \
+            -not -path "./backups/*" \
+            -print0 \
+          | while IFS= read -r -d '' f; do
+              shebang="$(head -1 "$f")"
+              if [[ "$shebang" == *zsh* ]]; then
+                zsh -n "$f" || { echo "FAIL (zsh -n): $f"; exit 1; }
+              else
+                bash -n "$f" || { echo "FAIL (bash -n): $f"; exit 1; }
+              fi
+            done
+          echo "All .sh files (excl. backups/) pass syntax check"
+
+      - name: shellcheck on bash scripts (warn-only)
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            find . \
+              -name "*.sh" \
+              -not -path "./.git/*" \
+              -not -path "./backups/*" \
+              -print0 \
+            | while IFS= read -r -d '' f; do
+                shebang="$(head -1 "$f")"
+                if [[ "$shebang" != *zsh* ]]; then
+                  shellcheck --severity=error "$f" || true
+                fi
+              done
+          else
+            echo "shellcheck not available, skipping"
+          fi

CHANGELOG.md

@@ -4,6 +4,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.12] - 2026-05-23
+
+### Added
+
+- `.github/workflows/quality.yml` — CI shell syntax check: `bash -n` on `install.sh`, `release.sh`, and all `.sh` files; `shellcheck` (warn-only).
+- `scripts/install-smoke.sh` — local install smoke test covering `install.sh --dry-run`, `release.sh` syntax, all `.sh` bash -n, `mqlaunch doctor --json`, and `mqlaunch selftest`.
+- `terminal/menus/mq-agent-menu.sh` — mq-agent submenu with ten commands across repo analysis, AI, and environment groups.
+- `Proof` section in README listing what is verified: dry-run, release validation, JSON health report, selftest, publish gate, HAL read-only commands, and CI syntax coverage.
+
+### Changed
+
+- README version badge bumped to `0.4.12`.
+- Main menu panel: added `g. Agent` quick access slot.
+- `mqlaunch.sh`: sources `mq-agent-menu.sh` when present.
+- `mq-main-menu.sh`: routes `g`/`G` and text aliases (`agent`, `score`, `signal`, `audit`, `doctor`) to mq-agent menu.
+
 ## [0.4.11] - 2026-05-20
 
 ### Changed

README.md

@@ -2,7 +2,7 @@
 
 ![macOS](https://img.shields.io/badge/platform-macOS-black)
 ![Shell](https://img.shields.io/badge/shell-zsh%20%2B%20bash-1f6feb)
-![Version](https://img.shields.io/badge/version-0.4.11-blue)
+![Version](https://img.shields.io/badge/version-0.4.12-blue)
 ![License](https://img.shields.io/badge/license-MIT-2ea44f)
 ![Status](https://img.shields.io/badge/status-active-success)
 
@@ -15,6 +15,19 @@ Stop memorizing commands. Start running workflows.
 
 ---
 
+## Proof
+
+- `install.sh` supports `--dry-run`, `--uninstall`, and `--yes` (non-interactive)
+- `release.sh` validates VERSION, README badge, and CHANGELOG before every release
+- `mqlaunch doctor` supports `--json` output — machine-readable health report
+- `mqlaunch selftest` runs launcher smoke checks and shell syntax lint
+- `mqlaunch release-check` gates every release on a `repo-signal` publish-readiness score
+- HAL bridge supports read-only audit, release brief, repo status, and CI status
+- All `.sh` files pass `bash -n` syntax check — verified by CI and `scripts/install-smoke.sh`
+- GitHub Pages has smoke-test coverage via CI
+
+---
+
 ## 🚀 Quick start
 
 ### Option 1 — Install (recommended)

VERSION

@@ -1 +1 @@
-0.4.11
+0.4.12

scripts/install-smoke.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Local install smoke test — verifies install.sh, release.sh, and core commands.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+pass() { printf "\033[1;32m[ OK ]\033[0m %s\n" "$*"; }
+fail() { printf "\033[1;31m[FAIL]\033[0m %s\n" "$*" >&2; exit 1; }
+step() { printf "\033[1;34m[STEP]\033[0m %s\n" "$*"; }
+
+cd "$REPO_ROOT"
+
+step "install.sh --help"
+bash install.sh --help > /dev/null && pass "install.sh --help"
+
+step "install.sh --dry-run"
+bash install.sh --dry-run --yes > /dev/null && pass "install.sh --dry-run"
+
+step "bash -n on install.sh"
+bash -n install.sh && pass "install.sh syntax OK"
+
+step "bash -n on release.sh"
+bash -n release.sh && pass "release.sh syntax OK"
+
+step "Syntax check all .sh files by shebang (exclude backups/)"
+find . \
+  -name "*.sh" \
+  -not -path "./.git/*" \
+  -not -path "./backups/*" \
+  -print0 \
+| while IFS= read -r -d '' f; do
+    shebang="$(head -1 "$f")"
+    if [[ "$shebang" == *zsh* ]]; then
+      zsh -n "$f" || { printf "\033[1;31m[FAIL]\033[0m zsh -n: %s\n" "$f" >&2; exit 1; }
+    else
+      bash -n "$f" || { printf "\033[1;31m[FAIL]\033[0m bash -n: %s\n" "$f" >&2; exit 1; }
+    fi
+  done
+pass "all .sh files pass syntax check"
+
+step "mqlaunch doctor --json"
+if command -v mqlaunch >/dev/null 2>&1; then
+  mqlaunch doctor --json | grep -q '"status"' && pass "mqlaunch doctor --json"
+else
+  printf "[SKIP] mqlaunch not in PATH — run after install\n"
+fi
+
+step "mqlaunch selftest"
+if command -v mqlaunch >/dev/null 2>&1; then
+  mqlaunch selftest && pass "mqlaunch selftest"
+else
+  printf "[SKIP] mqlaunch not in PATH — run after install\n"
+fi
+
+printf "\n\033[1;32m=== install smoke test passed ===\033[0m\n"