docs: strengthen public security signals

.github/workflows/test.yml

@@ -52,6 +52,9 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
 
+      - name: Install tools
+        run: brew install bats-core
+
       - name: Check for unsafe rm usage
         run: |
           echo "Checking for unsafe rm patterns..."
@@ -86,3 +89,10 @@ jobs:
             exit 1
           fi
           echo "✓ No secrets found"
+
+      - name: Run high-risk path regression tests
+        env:
+          BATS_FORMATTER: tap
+          LANG: en_US.UTF-8
+          LC_ALL: en_US.UTF-8
+        run: bats tests/core_safe_functions.bats tests/purge.bats tests/installer.bats