fix: v0.2.3 e2e distro loop, FIDO2 freeze, grouped prompts

Fix e2e.sh distro iteration broken by IFS setting (use bash array).
Fix FIDO2 detection freezing on macOS (check ssh-sk-helper, don't
invoke ssh-keygen). Group apply prompts into 6 categories. Fix Linux
gitleaks install hint.

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -4,11 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [0.2.2] - 2026-03-31
+## [0.2.3] - 2026-03-31
 
 ### Fixed
 - FIDO2 key generation on macOS — detect Homebrew's openssh via `ssh-sk-helper` (no freeze), use its `ssh-keygen` binary for hardware key generation
 - Linux gitleaks install hint now shows `apt`/`dnf` instead of `brew`
+- e2e test runner distro loop broken by `IFS` setting — use bash array
 
 ### Changed
 - Group interactive apply prompts into 6 categories with one-line explanations (replaces ~25 individual prompts)

git-harden.sh

@@ -10,7 +10,7 @@ IFS=$'\n\t'
 # ------------------------------------------------------------------------------
 # Constants
 # ------------------------------------------------------------------------------
-readonly VERSION="0.2.2"
+readonly VERSION="0.2.3"
 readonly BACKUP_DIR="${HOME}/.config/git"
 readonly HOOKS_DIR="${HOME}/.config/git/hooks"
 readonly ALLOWED_SIGNERS_FILE="${HOME}/.config/git/allowed_signers"

test/e2e.sh

@@ -18,8 +18,8 @@ readonly REPO_ROOT
 readonly CONTAINER_DIR="${SCRIPT_DIR}/containers"
 readonly IMAGE_PREFIX="git-harden-test"
 
-# Distro matrix: name=image
+# Distro matrix
-readonly DISTROS="ubuntu debian fedora alpine arch"
+readonly DISTROS=(ubuntu debian fedora alpine arch)
 
 # Colors (empty if not a terminal)
 if [ -t 2 ]; then
@@ -314,19 +314,19 @@ main() {
     if [ -n "$TARGET_DISTRO" ]; then
         # Validate distro name
         local valid=false
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             if [ "$d" = "$TARGET_DISTRO" ]; then
                 valid=true
                 break
             fi
         done
         if [ "$valid" = false ]; then
-            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS}"
+            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS[*]}"
         fi
 
         run_distro "$TARGET_DISTRO"
     else
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             run_distro "$d"
         done
     fi

test/git-harden.bats

@@ -1148,7 +1148,7 @@ EOF
 # v0.2.0: Version bump
 # ===========================================================================
 
-@test "--version reports 0.2.2" {
+@test "--version reports 0.2.3" {
     run bash "$SCRIPT" --version
-    assert_output --partial "0.2.2"
+    assert_output --partial "0.2.3"
 }