fix: make daemon reset conflict safe

internal/shell/shell.go

@@ -14,8 +14,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"golang.org/x/sys/unix"
-
 	"proxyctl/internal/profile"
 	"proxyctl/internal/securefs"
 	"proxyctl/internal/target"
@@ -194,41 +192,9 @@ func (a *Adapter) StartupPath() string      { return a.configuration.StartupFile
 
 // DiagnosticChecks performs no writes or command execution.
 func (a *Adapter) DiagnosticChecks(_ context.Context, _ *profile.Profile) []target.Check {
-	paths := []string{a.configuration.EnvironmentFile, a.configuration.RecoveryFile}
-	writable := true
-	var evidence []string
-	for _, path := range paths {
-		ok, detail := writablePath(path)
-		writable = writable && ok
-		evidence = append(evidence, detail)
-	}
 	return []target.Check{
 		{Name: "required commands", OK: true, Evidence: "Shell Target requires no external commands"},
-		{Name: "write authority", OK: writable, Evidence: strings.Join(evidence, "; ")},
-	}
-}
-
-func writablePath(path string) (bool, string) {
-	candidate := path
-	for {
-		info, err := os.Stat(candidate)
-		if err == nil {
-			if !info.IsDir() {
-				candidate = filepath.Dir(candidate)
-			}
-			if err := unix.Access(candidate, unix.W_OK); err != nil {
-				return false, candidate + " is not writable: " + err.Error()
-			}
-			return true, candidate + " is writable"
-		}
-		if !errors.Is(err, fs.ErrNotExist) {
-			return false, candidate + " cannot be inspected: " + err.Error()
-		}
-		parent := filepath.Dir(candidate)
-		if parent == candidate {
-			return false, path + " has no writable existing ancestor"
-		}
-		candidate = parent
+		target.ReadOnlyWriteAuthority(a.configuration.EnvironmentFile, a.configuration.RecoveryFile),
 	}
 }