Scope rendered provenance checks

Authored-By: Codex (GPT-5) <noreply@openai.com>

tests/bin/curl

@@ -2,6 +2,29 @@
 # Deterministic Gitea Markdown renderer stub for check.sh contract tests.
 set -euo pipefail
 
+connect_timeout=0
+total_timeout=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --connect-timeout)
+      [ "${2:-}" = "5" ] || exit 2
+      connect_timeout=1
+      shift 2
+      ;;
+    --max-time)
+      [ "${2:-}" = "15" ] || exit 2
+      total_timeout=1
+      shift 2
+      ;;
+    *) shift ;;
+  esac
+done
+[ "${connect_timeout}" -eq 1 ] && [ "${total_timeout}" -eq 1 ] || exit 2
+
+if printf '%s\n' "${PR_BODY}" | grep -Fq '[[stall-renderer]]'; then
+  exit 28
+fi
+
 if printf '%s\n' "${PR_BODY}" | grep -Fq '<!--'; then
   exit 0
 fi
@@ -34,12 +57,17 @@ printf '%s\n' "${PR_BODY}" | awk '
       in_script=1
       next
     }
+    if (lower ~ /^[ ]{0,3}<\/details([[:blank:]>])/) {
+      print "</details>"
+      next
+    }
     if (lower ~ /^[ ]{0,3}<details([[:blank:]>])/) {
       print "<details>"
       next
     }
     if (line ~ /^## Tracking[[:space:]]*$/) print "<h2>Tracking</h2>"
     else if (line ~ /^## Attribution[[:space:]]*$/) print "<h2>Attribution</h2>"
+    else if (line ~ /^- Fixes[[:space:]]/) print "<li>" substr(line, 3) "</li>"
     else if (line ~ /Authored-By:.*<noreply@[[:alnum:].-]+>/) {
       email=line
       sub(/^.*</, "", email)