fix(release): make the new CI scripts executable, and pin the exec-bit class

[DeusData]

What

Every unix build leg of release run 30499236230 died during packaging:

scripts/package-release.sh: line 190: scripts/ci/check-binary-composition.sh: Permission denied

The composition gate added in #1344 was committed 100644 while being invoked as a command. It passed every local check because my working copy had the exec bit — only the committed mode was wrong, which nothing you can run locally reveals.

scripts/ci/append-vt-notes.sh had the identical defect waiting in the verify step, the last step of the release. So this would have failed a second time, after two hours of tests, build, smoke and soak had already run.

Fix, on both sides

Either alone is sufficient; the pair is mode-proof.

• Both scripts are now 100755.
• Both call sites invoke them via bash, which is what most of this repo already does and which cannot break if a mode bit is lost to a patch application or a non-POSIX checkout.

Contract

tests/test_script_exec_bit_contract.sh pins the class: any tracked .sh whose committed mode is non-executable must not appear as the first word of a command in workflows, scripts/, test-infrastructure/ or the Makefiles.

Verified in both directions — it passes on this tree, and fails on the exact defect when the mode and call site are reverted together. It also joins backslash continuations before analysing, because its own first draft reported a false positive on a call whose interpreter sat on the preceding line:

... && bash \
    test-infrastructure/vm/vm-run-tests.sh --soak

A contract that cries wolf teaches people to ignore contracts, so that had to be right before it was worth having.

Verification

• 16/16 local contracts green (including the new one).
• Reproduced the CI failure locally: direct invocation without the bit gives rc=126; the bash form runs the gate.
• Product code untouched. The test phase of the failed run was 27/27 green on this exact tree, and a file mode cannot change a test outcome — so this re-release skips the test phase.

Note

Two commits rather than one: the first landed with only the mode changes because the call-site edits were not staged when it committed, and --amend is denied in this repo, so the follow-up is additive.