fix(ci): replace all rg calls with grep in CI-reachable scripts

ripgrep is not installed on GitHub Actions runners. Replace rg -q with
grep -qE and rg -o with grep -oE across 7 scripts called during the
fastlane and full-confidence CI jobs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: yuan-cloud

scripts/demo/competitor_bakeoff.sh

@@ -46,7 +46,7 @@ cargo run -p vifei-tui --bin vifei -- \
 
 ANSI_CAPTURE="$OUT_DIR/tour/ansi.capture"
 for token in "Level:" "Agg:" "Pressure:" "Drops:" "Export:" "Version:"; do
-  if ! rg -q "$token" "$ANSI_CAPTURE"; then
+  if ! grep -qE "$token" "$ANSI_CAPTURE"; then
     echo "[bakeoff] FAIL: explainability token missing: $token" >&2
     exit 1
   fi

scripts/demo/trust_demo_cut.sh

@@ -45,7 +45,7 @@ print(f"tier_a_drops={metrics['tier_a_drops']}")
 print(f"degradation_level_final={metrics['degradation_level_final']}")
 PY
 
-if ! rg -q '^tier_a_drops=0$' "$OUT_DIR/metrics-summary.txt"; then
+if ! grep -qE '^tier_a_drops=0$' "$OUT_DIR/metrics-summary.txt"; then
   echo "[trust-demo] FAIL: tier_a_drops is non-zero" >&2
   cat "$OUT_DIR/metrics-summary.txt" >&2
   exit 1

scripts/demo/visual_showcase_cut.sh

@@ -33,18 +33,18 @@ done
 
 required_truth_tokens=("Level:" "Agg:" "Pressure:" "Drops:" "Export:" "Version:")
 for token in "${required_truth_tokens[@]}"; do
-  if ! rg -q "$token" docs/assets/readme/truth-hud-showcase.txt; then
+  if ! grep -qE "$token" docs/assets/readme/truth-hud-showcase.txt; then
     echo "[visual-cut] FAIL: truth HUD token missing: $token" >&2
     exit 1
   fi
 done
 
-if ! rg -q "Action Now \\(Anomalies\\)" docs/assets/readme/incident-lens-narrow-72.txt; then
+if ! grep -qE "Action Now \\(Anomalies\\)" docs/assets/readme/incident-lens-narrow-72.txt; then
   echo "[visual-cut] FAIL: narrow incident proof missing anomaly action section" >&2
   exit 1
 fi
 
-if ! rg -q "Forensic controls:" docs/assets/readme/incident-lens-narrow-72.txt; then
+if ! grep -qE "Forensic controls:" docs/assets/readme/incident-lens-narrow-72.txt; then
   echo "[visual-cut] FAIL: narrow incident proof missing forensic control hints" >&2
   exit 1
 fi

scripts/testing/check_coverage_contract.sh

@@ -18,17 +18,17 @@ for required in "$MATRIX" "$FASTLANE_DOC" "$DEFER_REGISTER"; do
   [[ -f "$required" ]] || fail "CC0-files" "required contract file missing: $required" "test -f $required"
 done
 
-rg -q '^## v0\.1 Completeness Contract \("full enough"\)$' "$MATRIX" || \
-  fail "CC1-headings" "coverage matrix missing completeness contract heading" "rg -n '^## v0\\.1 Completeness Contract \\(\"full enough\"\\)$' $MATRIX"
-rg -q '^## Invariant And Decision Coverage Ownership$' "$MATRIX" || \
-  fail "CC1-headings" "coverage matrix missing invariant ownership heading" "rg -n '^## Invariant And Decision Coverage Ownership$' $MATRIX"
-rg -q '^## What Fastlane Covers$' "$FASTLANE_DOC" || \
-  fail "CC1-headings" "FASTLANE doc missing coverage section heading" "rg -n '^## What Fastlane Covers$' $FASTLANE_DOC"
+grep -qE '^## v0\.1 Completeness Contract \("full enough"\)$' "$MATRIX" || \
+  fail "CC1-headings" "coverage matrix missing completeness contract heading" "grep -nE '^## v0\\.1 Completeness Contract \\(\"full enough\"\\)$' $MATRIX"
+grep -qE '^## Invariant And Decision Coverage Ownership$' "$MATRIX" || \
+  fail "CC1-headings" "coverage matrix missing invariant ownership heading" "grep -nE '^## Invariant And Decision Coverage Ownership$' $MATRIX"
+grep -qE '^## What Fastlane Covers$' "$FASTLANE_DOC" || \
+  fail "CC1-headings" "FASTLANE doc missing coverage section heading" "grep -nE '^## What Fastlane Covers$' $FASTLANE_DOC"
 
 mapfile -t referenced_paths < <(
-  rg -o '`[^`]+`' "$MATRIX" \
+  grep -oE '`[^`]+`' "$MATRIX" \
     | tr -d '`' \
-    | rg '^(docs/|scripts/|crates/|\.github/)' \
+    | grep -E '^(docs/|scripts/|crates/|\.github/)' \
     | sort -u
 )
 

scripts/testing/check_pty_flake_contract.sh

@@ -33,7 +33,7 @@ EOF
 }
 
 if [[ -f "$FASTLANE_RUN_JSONL" && -f "$FASTLANE_SUMMARY" ]]; then
-  if rg -q '"run_id":"fastlane-v0\.1"' "$FASTLANE_RUN_JSONL"; then
+  if grep -qE '"run_id":"fastlane-v0\.1"' "$FASTLANE_RUN_JSONL"; then
     echo "CONTRACT_FAIL[PTY0-lane-scope] wrong lane directory: '$OUT_DIR' is a fastlane output bundle."
     echo "hint: this checker validates full-confidence PTY assertion logs only."
     echo "replay: scripts/testing/check_pty_flake_contract.sh .tmp/full-confidence"

scripts/testing/check_trust_demo_cut_contract.sh

@@ -24,17 +24,17 @@ for file in "${required[@]}"; do
   fi
 done
 
-if ! rg -q '^trust_demo_status=PASS$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
+if ! grep -qE '^trust_demo_status=PASS$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
   echo "[trust-demo-contract] summary missing PASS marker" >&2
   exit 1
 fi
 
-if ! rg -q '^tier_a_drops=0$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
+if ! grep -qE '^tier_a_drops=0$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
   echo "[trust-demo-contract] summary missing zero-drop proof" >&2
   exit 1
 fi
 
-if ! rg -q '^blocked_items=[1-9][0-9]*$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
+if ! grep -qE '^blocked_items=[1-9][0-9]*$' "$out_dir/TRUST_DEMO_SUMMARY.txt"; then
   echo "[trust-demo-contract] refusal summary missing blocked items" >&2
   exit 1
 fi

scripts/testing/check_visual_showcase_cut_contract.sh

@@ -20,13 +20,13 @@ for file in "${required[@]}"; do
   fi
 done
 
-if ! rg -q '^visual_showcase_status=PASS$' "$out_dir/VISUAL_SHOWCASE_SUMMARY.txt"; then
+if ! grep -qE '^visual_showcase_status=PASS$' "$out_dir/VISUAL_SHOWCASE_SUMMARY.txt"; then
   echo "[visual-cut-contract] summary missing PASS marker" >&2
   exit 1
 fi
 
 for asset in incident-lens-showcase.svg forensic-lens-showcase.svg truth-hud-showcase.svg incident-lens-narrow-72.svg; do
-  if ! rg -q "^${asset}_blake2s=[0-9a-f]{64}$" "$out_dir/VISUAL_SHOWCASE_SUMMARY.txt"; then
+  if ! grep -qE "^${asset}_blake2s=[0-9a-f]{64}$" "$out_dir/VISUAL_SHOWCASE_SUMMARY.txt"; then
     echo "[visual-cut-contract] summary missing hash for $asset" >&2
     exit 1
   fi