fix: harden operations and configuration recovery

scripts/test-hermetic.sh

@@ -76,7 +76,7 @@ snapshot() {
 snapshot >"$work/before"
 (
   cd "$repo"
-  go test ./...
+  go test -count=1 ./...
 )
 snapshot >"$work/after"
 cmp "$work/before" "$work/after"

scripts/verify-clean-machine.sh

@@ -17,15 +17,41 @@ snapshot_host_path() {
     return
   fi
 
-  # Avoid pipelines: traversal, stat, hash, and sort failures must stop the
-  # verification rather than being mistaken for an unchanged host snapshot.
-  find -H "$path" -xdev \
+  stat --printf='top-metadata\t%F\t%a\t%u\t%g\t%N\n' -- "$path"
+  if { [ -d "$path" ] && { [ ! -r "$path" ] || [ ! -x "$path" ]; }; } || \
+     { [ ! -d "$path" ] && [ ! -r "$path" ]; };
+  then
+    printf 'unreadable\t%s\n' "$path"
+    return
+  fi
+
+  traversal_complete=true
+  if ! find -H "$path" -xdev \
     -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
-    >"$work/host-snapshot-metadata"
+    >"$work/host-snapshot-metadata" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
   LC_ALL=C sort "$work/host-snapshot-metadata"
-  find -H "$path" -xdev -type f -exec sha256sum -- {} + \
-    >"$work/host-snapshot-content"
+
+  if ! find -H "$path" -xdev \
+    \( \( -type d \( ! -readable -o ! -executable \) \) -o \( -type f ! -readable \) \) \
+    -printf='unreadable\t%p\n' >"$work/host-snapshot-unreadable" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
+  LC_ALL=C sort "$work/host-snapshot-unreadable"
+
+  if ! find -H "$path" -xdev -type f -readable -exec sha256sum -- {} + \
+    >"$work/host-snapshot-content" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
   LC_ALL=C sort "$work/host-snapshot-content"
+
+  if [ "$traversal_complete" = false ]; then
+    printf 'unreadable-descendant\t%s\n' "$path"
+  fi
 }
 
 snapshot_host() {