fix(#197): add fallback path for companion scripts in post-fix.sh

[fullsend-ai-coder]

When post-fix.sh runs from the content-addressed cache (sha256//content), process-fix-result.py is not co-located. Add a fallback that checks FULLSEND_DIR/scripts/ when the companion is not found at the BASH_SOURCE-relative path.

This is the same class of bug as the skill companion resolution issue (fullsend-ai#2705), applied to post-scripts. The pre-commit tool companions in post-code.sh were already replaced with inline installs, so only post-fix.sh needed the fallback.

Add post-fix-test.sh to verify the fallback resolution logic and register it in the Makefile script-test target.

---

Closes #197

Post-script verification

• Branch is not main/master (agent/197-fix-companion-fallback)
• Secret scan passed (gitleaks — b776cf6006a12016eaa21412dc65a3001100e801..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:30 PM UTC · Completed 3:39 PM UTC
Commit: b776cf6 · View workflow run →

[fullsend-ai-review]

Review — PR #508

Verdict: approve

Summary

This PR adds a fallback path resolution for process-fix-result.py in post-fix.sh, fixing the companion script co-location bug described in #197. When post-fix.sh runs from the content-addressed cache (sha256/<hash>/content), the BASH_SOURCE-relative path no longer finds the companion Python script. The fallback checks ${FULLSEND_DIR}/scripts/ — the workspace scripts directory — which is reliably set in CI via action.yml.

The change is small (6 lines of production code), correctly scoped to the stated issue, and follows the approach recommended in #197 (Option A). A 95-line test file validates the resolution logic, and the Makefile script-test target is updated. Existing error handling at line 322 provides a safe degradation path if both locations fail.

Security: The fallback runs AFTER all security gates (protected-path check, secret scan, pre-commit). FULLSEND_DIR is a runner-controlled variable (never agent/sandbox-controlled). The scripts/ directory is in PROTECTED_PATHS, so agent writes there would be blocked before the fallback code is reached.

Observations

#	Sev	Category	File	Description
1	low	test-fidelity	post-fix-test.sh	Test reimplements the resolution logic rather than testing the actual post-fix.sh code. If the production logic diverges, the test could pass while production is wrong. This matches existing test patterns in the repo (e.g., post-code-test.sh), but consider adding a comment in post-fix.sh near the fallback noting the test mirrors this logic.
2	low	observability	post-fix.sh:306-309	When the fallback also fails, the existing warning at line 323 reports only the fallback path, not both attempted paths. Consider logging both for easier debugging in failure scenarios.

---

Labels: Bug fix for post-script companion resolution in dispatch pipeline