v0.9.3: fix F-5 temp-file leak — RETURN trap now cleans both temps (rules_tmp + _norm_tmp); + fail-safe CR-detection comment; MANIFEST regenerated

Vera FAIL on v0.9.2 was the stdin-path temp leak (bash RETURN traps don't stack).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

MANIFEST

@@ -31,7 +31,7 @@ install-larry.sh	072a036ad5bbf80e866cfd2dd74de50f8defd69a3f835032579b0cb9d421ad5
 uninstall-larry.sh	c53ad2d8354c7adeb243b541f027f3f481e4a8661eecfd7af14d7ca53cfcaad9
 
 # Metadata
-VERSION	f34248c2449a022d41c918d1e995ad85859a1e9f0e6f89d0af23ae4a55519f71
+VERSION	38ecaa1e4c36c6691944c83df7671fca8b86f5cbf2d4e22c0012aa52df14b149
 MANUAL.md	5ff54d6d5fae826f8b3da1eb3be6476076bb15f9b1417a4de285e59ea37e1b1f
 CHANGELOG.md	934007dc1b08b6c90120f009e3cc7870815e7b251fdf8f6629aa4c004c866017
 
@@ -72,7 +72,7 @@ lib/lessons.sh	225e899ed72ce20906cc454c5f5db87d605859e5e17431731a2ce481623f4e16
 lib/journal.sh	11c62a2d47b6b67a2f423fd8b86c454126df18d2dc3e150233bbd08293e39fe7
 
 # HL7 utilities
-lib/hl7-sanitize.sh	5bb409b3e5eae545e362e1313cd47c6835d56177dfe2efafd519e4ceedb2a82b
+lib/hl7-sanitize.sh	efd333dc3e267cf2280433e53bbb910023d0bc4b30724181b53873b410d83005
 lib/hl7-desanitize.sh	2e5462a61ab1e8bd3fefb956bace8ca1ae33397a09024cbe766fa55c37a5aad6
 lib/hl7-diff.sh	d2cc179bf25dd8e808d46d4211d1926f36645cec8443d0ea910675093eb89d72
 lib/hl7-field.sh	a640f7cbd9521dc96171ee1dbdf909170262101a1d7a433f6f0ce2bea8d42b02

VERSION

@@ -1 +1 @@
-0.9.2
+0.9.3

lib/hl7-sanitize.sh

@@ -485,8 +485,12 @@ AWK_END
   else
     # stdin — buffer to a temp file so we can inspect for CR presence.
     local _norm_tmp; _norm_tmp=$(mktemp)
-    trap 'rm -f "$_norm_tmp"' RETURN
+    # F-5 fix: bash RETURN traps do NOT stack — this REPLACES the earlier rules_tmp trap
+    # (~line 357), so it MUST clean BOTH temps or $rules_tmp leaks one mktemp file per stdin call.
+    trap 'rm -f "$rules_tmp" "$_norm_tmp"' RETURN
     cat /dev/stdin > "$_norm_tmp"
+    # CR-detection via python3; if python3 is absent the test fails and the else (normalise)
+    # branch runs — the intentional FAIL-SAFE default (normalise, never skip sanitization).
     if python3 -c "import sys; d=open(sys.argv[1],'rb').read(); sys.exit(0 if b'\r' in d else 1)" "$_norm_tmp" 2>/dev/null; then
       awk -v RULES_FILE="$rules_tmp" -v TABLE="$table" -v STRICT="$strict" \
           -v UPDATE_TABLE="$update_table" \