fix(build): the standalone binary is over its 500 KiB budget on main, and CI does not catch it

[Chemaclass]

Problem

tests/unit/project/build_test.sh::test_built_binary_stays_below_500_kib fails on a clean main:

Expected '513422'
to be less or equal than '512000'

Measured on main at 5e5c803, with no working-tree changes:

git stash -u && bash build.sh bin && wc -c < bin/bashunit
# 513422   (501 KiB)

Why nobody noticed

The test opens with:

if ! build_optimizer_is_available; then
  bashunit::skip "shfmt and jq are required for standalone optimization"
  return
fi

CI images do not have both shfmt and jq, so the test skips there and only ever runs on a contributor's machine. A budget that is enforced nowhere the merge gate can see is not enforced. That is how the recent run of merges (#1037–#1042) crossed it without a single red check.

Two separate things to fix

1. Get back under budget — or move the budget deliberately, with the new number written down. 501 KiB against a 500 KiB limit is a 0.3% overshoot, so this is a decision about where the line belongs, not an emergency.
2. Make the gate real. Either install shfmt + jq in the workflow that runs this test, or assert the unoptimised size (which needs neither) so the check cannot silently skip. A skipped budget test is worse than no budget test, because it reads as green.

Notes

• The build.sh comment-stripping from perf(build): strip standalone comments #990 bought ~22%; the growth since is ordinary feature accretion, not a regression in the builder.
• Not urgent for correctness — the binary works; it is only past a self-imposed size line.

Acceptance criteria

• ./bashunit tests/unit/project/build_test.sh passes on a clean checkout with shfmt and jq installed
• The size check runs (not skips) in at least one CI job, so a future overshoot blocks a merge
• If the budget is raised rather than met, the new number and the reasoning are recorded

[Chemaclass]

Correction to the issue body: CI does run this check. .github/workflows/build.yml installs shfmt via go install and both runners ship jq, so Build & Verify executes the size test rather than skipping it.

The gate worked — main is red on it:

failure 5e5c803 feat(assert): add numeric range assertions (#1037)
success 54f9e97 fix(reports): GitHub Actions annotations never reached the pull request (#1042)

So item 2 ("make the gate real") does not apply. The actual problem is narrower: the budget was exceeded and the PR was merged red anyway. Every PR opened since is blocked by it.

On item 1, the options measured on the current artifact (518,493 bytes with #1032 applied):

approach	bytes	verdict
as-is	518,493	over
strip blank lines	515,249	still over, and unsafe — a blank line inside a heredoc is content, the hazard #990 already had to handle
shfmt --minify	471,673	reaches it, but strips all indentation from the artifact

Blank-line stripping does not even get there, so the real choice is minify-or-raise. Raising it, with the number and reasoning recorded.

[Chemaclass]

Done in #1046 (merged). main is green again.

Budget raised 512000 → 557056 bytes (500 → 544 KiB), with the measurements recorded next to the assertion.

The issue's second item does not apply — I was wrong that CI skipped the check. build.yml installs shfmt via go install and both runners ship jq, so Build & Verify runs it. The gate worked; #1037 was merged while it was red. Nothing to fix in the workflow.

Raising rather than shrinking, because neither alternative held up: stripping blank lines saves 3244 bytes (still over the old line) and is unsafe — a blank line inside a heredoc is content, the hazard #990 already had to handle — and shfmt --minify only reaches it by stripping all indentation out of the shipped artifact, trading permanent readability for 0.3%.