fix(support-bundle): omit macOS AppleDouble files from the diagnostics archive

[roshangupta00750]

Support bundles are the artifact users attach to a bug report, so whatever lands in the tarball is what a maintainer reads.

Problem

scripts/ods-support-bundle.sh creates the archive with a bare tar:

tar -czf "$ARCHIVE_PATH" -C "$OUTPUT_DIR" "$BUNDLE_NAME"

On macOS tar is bsdtar, which writes an AppleDouble ._<name> companion member for every archived file that carries extended attributes. The bundle is assembled from config, logs and command output under paths that routinely pick up xattrs (quarantine and provenance attributes), so those companions end up inside the archive next to real members.

They are easy to miss because tar -tzf filters ._* entries out of its own listing — the archive looks clean while the members are present. They reappear when the bundle is unpacked, and any consumer that walks the tar without filtering (Python tarfile, for one) sees them raw: binary blobs sitting next to each real file, which break tooling that decodes bundle files as text.

The same construct in ods-backup.sh was fixed for this reason in #5765. This is the remaining unguarded archive writer.

There is independent evidence in the repo that the gap is reachable: the new test added by #5873 has to pass COPYFILE_DISABLE="1" in the subprocess environment to keep its own support-bundle run clean. That works for that one call site; every other invocation — including a user running the script by hand to attach a bundle to an issue — is still unguarded.

Fix

Set the variable on the archive step itself, so the guarantee holds for every caller rather than for the callers that remember:

COPYFILE_DISABLE=1 tar -czf "$ARCHIVE_PATH" -C "$OUTPUT_DIR" "$BUNDLE_NAME"

GNU tar has no such behaviour and ignores the variable, so Linux is byte-for-byte unchanged.

Tests

Two assertions added to tests/test-support-bundle.sh, which already builds a real archive and lists its members:

• Behavioural — no archive member matches (^|/)\._. This has teeth on macOS.
• Contract — the archive is created under COPYFILE_DISABLE. bsdtar behaviour cannot be reproduced on Linux CI, so without this a regression would pass there unnoticed; with it, any future edit dropping the guard fails in test-linux.yml.

Validation

	result
macOS 15, bash 5.2	22 passed, 0 failed (was 20 before the new assertions)
Linux, GNU tar 1.35	22 passed, 0 failed — variable is a no-op, no behaviour change
Guard removed, tests kept	21 passed, 1 failed — the contract assertion fails as intended
shellcheck -S style	4 findings before, 4 after — none introduced

No conflict with #5873: that PR edits read_env_value near line 298, this one the archive step near line 818.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.