Make managed PHP-FPM log repair tests portable under service umask 002 and keep rotation idempotent

[chubes4]

Summary

Improve PHP-FPM logrotate idempotence and make the regression fixture umask-safe.

What changed

• Compare repaired package-rule text with its original before writing.
• Capture and preserve initial modes for untouched target.log and other.log.
• Assert repeated apply preserves package-rule content and mtime while retaining existing scope, non-root, dry-run, and duplicate-stanza checks.
• Bounded observations passed under umask 002 and 022.

How to test

1. Run umask 002 && bash tests/systems-capabilities.sh; expect passes as recorded by Cook's deterministic gate.
2. Run umask 022 && bash tests/systems-capabilities.sh; expect passes as recorded by Cook's deterministic gate.
3. Run bash tests/source-mode.sh; expect passes as recorded by Cook's deterministic gate.

Compatibility

Low risk. Runtime behavior changes only by avoiding redundant rewrites of already-correct package rules; fixture assertions are more portable across umasks.

Evidence

• Verified command umask 002 && bash tests/systems-capabilities.sh: status=succeeded; candidate commit be20f4b60ff6c5eaba87b0fa720c280b4e59465e, tree 312c7a276f5af59994e48d6561534fb4c20dfd91, fingerprint fa26182a382f03f0497d6efc7dfa68471576344a462769d511533cbfe6c552e5; durable gate gate-1
• Verified command umask 022 && bash tests/systems-capabilities.sh: status=succeeded; candidate commit be20f4b60ff6c5eaba87b0fa720c280b4e59465e, tree 312c7a276f5af59994e48d6561534fb4c20dfd91, fingerprint fa26182a382f03f0497d6efc7dfa68471576344a462769d511533cbfe6c552e5; durable gate gate-2
• Verified command bash tests/source-mode.sh: status=succeeded; candidate commit be20f4b60ff6c5eaba87b0fa720c280b4e59465e, tree 312c7a276f5af59994e48d6561534fb4c20dfd91, fingerprint fa26182a382f03f0497d6efc7dfa68471576344a462769d511533cbfe6c552e5; durable gate gate-3
• Base unchanged since verification: main remains at 898682f.
• CI expected: Homeboy CI after push
• Candidate adoption provenance: the candidate was promoted from the recorded Cook task execution.
• Cook deterministic verification: 3 gate(s) completed green.
• Durable run execution: Succeeded
• Reviewer-resolvable evidence from source_refs[0]: Agent runtime is locked out of the operational actions it needs during incidents #611
• Task objective: On current main (already includes the group-private PHP-FPM log repair), improve only the regression fixture and logrotate idempotence. tests/systems-capabilities.sh asserts unrelated untouched target.log/other.log are 0644, but on Linux with umask 002 they start 0664. Capture initial modes and assert unchanged after apply; keep exact 0640 assertions for repaired PHP-FPM current and rotated logs and unchanged directory, symlink, parent, debug.log. In systems_capabilities_repair_php_fpm_logrotate, avoid rewriting an already-correct package rule: compare final text with original before write. Add a test that repeated apply preserves the package rule mtime in addition to content. Retain non-root/dry-run tests and no duplicate stanza. Keep scope small, public-safe disclosure. Verify both umask 002 and 022.
• Verified candidate scope: 2 changed file(s): lib/systems-capabilities.sh, tests/systems-capabilities.sh.
• Verified finalization base: main at 898682f
• deterministic gate passed: sh -lc bash tests/source-mode.sh (Passed)
• deterministic gate passed: sh -lc umask 002 && bash tests/systems-capabilities.sh (Passed)
• deterministic gate passed: sh -lc umask 022 && bash tests/systems-capabilities.sh (Passed)

AI assistance

• AI assistance: Yes
• Tool(s): Homeboy (opencode)
• Model: openai/gpt-5.6-luna
• Used for: Test-focused regression work based on the existing repair predicate and implementation family. Changes are limited to lib/systems-capabilities.sh and tests/systems-capabilities.sh; final deterministic gates remain controller-owned.