fix: close Ticket 11 hardening review gaps

scripts/test-hermetic.sh

@@ -12,15 +12,45 @@ snapshot_path() {
     return
   fi
 
-  # Keep traversal, metadata collection, hashing, and sorting as separate
-  # commands so set -e observes every failure without relying on pipefail.
-  find -H "$path" -xdev \
+  # An unprivileged CI user cannot traverse every protected system root. Keep
+  # a stable top-level observation for those roots instead of using sudo or
+  # failing before the tests run. Readable roots are still traversed fully and
+  # every readable regular file is content-hashed.
+  stat --printf='top-metadata\t%F\t%a\t%u\t%g\t%N\n' -- "$path"
+  if { [ -d "$path" ] && { [ ! -r "$path" ] || [ ! -x "$path" ]; }; } || \
+     { [ ! -d "$path" ] && [ ! -r "$path" ]; };
+  then
+    printf 'unreadable\t%s\n' "$path"
+    return
+  fi
+
+  traversal_complete=true
+  if ! find -H "$path" -xdev \
     -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
-    >"$work/snapshot-metadata"
+    >"$work/snapshot-metadata" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
   LC_ALL=C sort "$work/snapshot-metadata"
-  find -H "$path" -xdev -type f -exec sha256sum -- {} + \
-    >"$work/snapshot-content"
+
+  if ! find -H "$path" -xdev \
+    \( \( -type d \( ! -readable -o ! -executable \) \) -o \( -type f ! -readable \) \) \
+    -printf='unreadable\t%p\n' >"$work/snapshot-unreadable" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
+  LC_ALL=C sort "$work/snapshot-unreadable"
+
+  if ! find -H "$path" -xdev -type f -readable -exec sha256sum -- {} + \
+    >"$work/snapshot-content" 2>/dev/null
+  then
+    traversal_complete=false
+  fi
   LC_ALL=C sort "$work/snapshot-content"
+
+  if [ "$traversal_complete" = false ]; then
+    printf 'unreadable-descendant\t%s\n' "$path"
+  fi
 }
 
 snapshot() {
@@ -50,4 +80,4 @@ snapshot >"$work/before"
 )
 snapshot >"$work/after"
 cmp "$work/before" "$work/after"
-printf 'full Go suite passed without changing host Shell, APT, Docker, GNOME, or system-service state\n'
+printf 'full Go suite passed unprivileged: readable host configuration content and metadata were unchanged; protected roots retained the same top metadata and unreadable markers; no sudo was used\n'