Explicit encoding + DEVNULL stdin on every subprocess.run, SIGKILL via getattr, BOM-tolerant reads in the pause e2e cells (writes stay plain utf-8), and the macOS-only launchd test waives os.getuid inline. The footgun lint runs on every file regardless of platform guards.