fix: feed curl auth config on stdin (no process substitution on Git Bash)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

catalogue-publish/test.sh

@@ -20,4 +20,24 @@ OUT="$(GITHUB_ACTION_PATH="$HERE" INPUT_APP=silvermail INPUT_FILE="$TMP/App-1.0.
 for n in Platform=Windows Format=Nupkg VersionCode=1000000 AppSlug=silvermail; do
   printf '%s' "$OUT" | grep -qF -- "$n" && ok "dry-run has $n" || bad "dry-run missing $n"; done
 printf '%s' "$OUT" | grep -qF -- "$SECRET" && bad "key leaked" || ok "key not printed"
+
+# -K must not use process substitution (breaks native curl under Git Bash).
+grep -nE -- '-K[[:space:]]+<\(' "$HERE/publish-to-catalogue.sh" >/dev/null && bad "uses -K <(...)" || ok "no process substitution for -K"
+
+# Fake curl: header must arrive on stdin, never in argv.
+mkdir "$TMP/bin"
+cat > "$TMP/bin/curl" <<'F'
+#!/usr/bin/env bash
+out=""; k=""
+while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift 2;; -K) k="$2"; shift 2;; *) printf '%s
+' "$1" >> "$FAKE_ARGS"; shift;; esac; done
+printf '%s' "$k" > "$FAKE_K"
+cat > "$FAKE_STDIN"
+echo '{}' > "$out"; printf 201
+F
+export FAKE_ARGS="$TMP/args" FAKE_K="$TMP/k" FAKE_STDIN="$TMP/stdin"; : > "$FAKE_ARGS"
+PATH="$TMP/bin:$PATH" CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/publish-to-catalogue.sh"   --slug a --platform windows --arch x64 --format nupkg --version 1.0.0 --version-code 1 --channel beta "$TMP/App-1.0.0.nupkg" >/dev/null 2>&1   && ok "fake-curl publish exit 0" || bad "fake-curl publish failed"
+[ "$(cat "$TMP/k")" = "-" ] && ok "-K -" || bad "-K arg is '$(cat "$TMP/k")'"
+grep -qF "Authorization: Bearer $SECRET" "$TMP/stdin" && ok "header on stdin" || bad "header not on stdin"
+grep -qF "$SECRET" "$TMP/args" && bad "key in argv" || ok "key not in argv"
 exit $FAILS