Run logging smoke tests on Bash 4.2

[codeforester]

Summary

• add one standalone logging smoke script that runs under any supported Bash
  and can assert an exact interpreter version
• exercise default INFO output, dependency category isolation, dotted-category
  inheritance, log_is_enabled, DEBUG persistence, mode 0600, file logging,
  UTC timestamps, and VERBOSE compatibility
• run the smoke in normal local validation
• add a dedicated Ubuntu job using the Docker Official Bash 4.2.53 image pinned
  to its immutable linux/amd64 manifest digest
• isolate the compatibility container with a read-only repository, no network,
  dropped capabilities, no-new-privileges, a PID limit, and a bounded tmpfs

Issue

Closes #193

Validation

• tests/bash-42-logging-smoke.sh — passed on local Bash 5.3.15
• tests/bash-42-logging-smoke.sh 5 3 15 — exact-version assertion path passed
• ./tests/validate.sh — 321 BATS tests plus the logging smoke passed
• tests/lint-warnings.sh
• workflow YAML parsed successfully
• git diff --check

Notes

• This PR is stacked on Harden the primary log sink #195; its base branch is
  bug/192-20260725-primary-log-sink-hardening.
• The local Docker daemon was unavailable, so the new GitHub Actions job is the
  exact Bash 4.2.53 runtime proof.
• The pinned image is
  docker.io/library/bash@sha256:0931edd3941d0603cb3d5da1cb298cf3eb6a579e09e094c3e34e2d5e9df8cddc.
• The complete BATS suite remains on hosted macOS and Ubuntu runners; the
  minimal 4.2 image runs only the focused compatibility contract.
• No changelog entry is needed for this CI-only change.
• VERSION remains unchanged; this work is targeted to the v1.4.0
  milestone.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>.
• Pull request is scoped to one issue, unless a documented multi-issue exception applies.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated when behavior or user-facing commands change.
• CHANGELOG is updated when the change is notable and release-worthy.
• Pull request includes Fixes #<issue> or Closes #<issue> when merge should close the issue.