fix: harden release validation

scripts/test-hermetic.sh

@@ -5,21 +5,31 @@ repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT HUP INT TERM
 
+snapshot_path() {
+  path=$1
+  if [ ! -e "$path" ] && [ ! -L "$path" ]; then
+    printf 'absent\t%s\n' "$path"
+    return
+  fi
+
+  # Keep traversal, metadata collection, hashing, and sorting as separate
+  # commands so set -e observes every failure without relying on pipefail.
+  find -H "$path" -xdev \
+    -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
+    >"$work/snapshot-metadata"
+  LC_ALL=C sort "$work/snapshot-metadata"
+  find -H "$path" -xdev -type f -exec sha256sum -- {} + \
+    >"$work/snapshot-content"
+  LC_ALL=C sort "$work/snapshot-content"
+}
+
 snapshot() {
   for path in \
     "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
     /etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
     /etc/systemd/system/docker.service.d
   do
-    if [ -d "$path" ]; then
-      find "$path" -type f -print0 2>/dev/null | sort -z | xargs -0 -r sha256sum 2>/dev/null || ls -ld "$path"
-    elif [ -r "$path" ]; then
-      sha256sum "$path"
-    elif [ -e "$path" ]; then
-      ls -ld "$path"
-    else
-      printf 'absent  %s\n' "$path"
-    fi
+    snapshot_path "$path"
   done
   if command -v gsettings >/dev/null 2>&1; then
     gsettings list-recursively org.gnome.system.proxy 2>&1 || true