Harden web search and docs defaults

scripts/release-check

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT}"
+
+tmp_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "${tmp_dir}"
+}
+trap cleanup EXIT
+
+check_node() {
+  local file
+  for file in "$@"; do
+    node --check "${file}"
+  done
+}
+
+git diff --check
+git ls-files --cached --error-unmatch \
+  docker/web-search/patch-mcp-web-search.mjs \
+  docker/web-search/overrides/bing.js \
+  docker/docs/constraints.txt \
+  scripts/smoke-web-search.mjs \
+  scripts/release-check >/dev/null
+bash -n bin/context-kit
+bash -n scripts/release-check
+sh -n docker/docs/entrypoint.sh
+check_node docker/web-search/patch-mcp-web-search.mjs docker/web-search/overrides/bing.js scripts/smoke-web-search.mjs
+
+node -e 'const fs=require("node:fs"); JSON.parse(fs.readFileSync("snippets/opencode.json", "utf8")); JSON.parse(fs.readFileSync("snippets/claude.mcp.json", "utf8"));'
+bin/context-kit install opencode > "${tmp_dir}/opencode.json"
+bin/context-kit install opencode --absolute > "${tmp_dir}/opencode-absolute.json"
+bin/context-kit install claude > "${tmp_dir}/claude.json"
+bin/context-kit install claude --absolute > "${tmp_dir}/claude-absolute.json"
+node -e 'const fs=require("node:fs"); for (const file of process.argv.slice(1)) JSON.parse(fs.readFileSync(file, "utf8"));' \
+  "${tmp_dir}/opencode.json" \
+  "${tmp_dir}/opencode-absolute.json" \
+  "${tmp_dir}/claude.json" \
+  "${tmp_dir}/claude-absolute.json"
+
+bin/context-kit redaction-check
+docker compose -p context-kit -f compose.yml config >/dev/null
+bin/context-kit build
+bin/context-kit doctor
+node scripts/smoke-web-search.mjs bin/context-kit web-search
+
+printf 'pass release-check\n'