#27406 ci: check-objc-selectors.sh, so the selector probe runs as a cmux-ci step

Summary

• Adds scripts/cmux-next/check-objc-selectors.sh, a bash wrapper of check-objc-selectors.py. With it, the selector probe (--probe --write, which needs a Mac) can run as a cmux-ci run step instead of over SSH. The worker runs every step script with /bin/bash, so the controller can only allowlist a bash script.
• The hq side is manaflow-ai/cmuxterm-hq#5101. It allowlists this wrapper: class light, no env, scripts/cmux-next/objc-selector-table.json as the only artifact, and only the argument lists none, --probe and --probe --write. The wrapper refuses every other argument list too, and it checks only its own checkout.
• Why: agents ran the probe on a fleet mini over SSH twice because cmux-ci run refused the .py: f758ea360c0 (2026-10-28) and perf/chrome-parity e37f828cba7 (2026-10-29).

After both land and the controller is deployed:
cmux-ci run --class light --script scripts/cmux-next/check-objc-selectors.sh --ref SHA --key KEY --arg --probe --arg --write --artifact scripts/cmux-next/objc-selector-table.json

Testing

python3 tests/test_check_objc_selectors_step.py. Red on the first commit (the wrapper does not exist), green on the head (2 tests OK).

Observed / Not run

• Observed: the test above on Linux; prepush-gate.py: no new violations.
• Not run: --probe on a Mac through the wrapper. It needs the hq allowlist to be deployed first.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds scripts/cmux-next/check-objc-selectors.sh, a bash wrapper for check-objc-selectors.py, so the selector probe (--probe --write, Mac-only) can run as a cmux-ci run step instead of over SSH.

• The wrapper matches arguments one at a time, so it accepts only none, --probe, or --probe --write as separate arguments, and runs the check against its own checkout from any working directory. A missing python3 prints an error and exits 127.
• Adds a test suite registered in tests/test-execution.toml. The no-argument test requires super calls found and the same summary and exit code as the check run directly, proving the wrapper checks this checkout.
• The companion hq side (manaflow-ai/cmuxterm-hq#5101) allowlists this wrapper; until it is deployed, the probe still needs SSH.