ci: restore live FUSE and Slack coverage

[misrasaurabh1]

Summary

• run unchanged Linux FUSE smoke and live product-path scripts inside a pinned privileged container, then drop to the ordinary hosted-runner UID before mounting
• isolate container-built binaries from host target/ artifacts with a disposable target directory
• keep /dev/fuse, setuid fusermount3, required-mode assertions, and the real read/write/rename/unmount coverage intact across hosted image rollouts
• make Slack live CI refresh and persist its rotating OAuth credential every run, with serialization, permission preflight, and retries
• add an exact workflow contract test so runner workarounds cannot silently weaken commands, privileges, build isolation, or live-workflow triggers

Root causes

• the current GitHub hosted-agent provisioner rejects otherwise-valid host-user FUSE mounts with Operation not permitted, on both newly provisioned Ubuntu 22.04 and 24.04 agents
• Slack refresh handles are single-use; CI consumed the replacement credential in an ephemeral runner without persisting it, leaving the environment secret stale

Validation

All PR checks are green on the final revision, including:

• Linux FUSE smoke and Linux FUSE e2e using clean isolated container builds
• Linux, Windows, and macOS test suites
• local e2e behavior and OAuth service tests
• exact CI workflow contract test
• shell syntax checks, cargo fmt --all -- --check, actionlint, and git diff --check
• automated review: no high-confidence issues found

The unchanged Linux FUSE smoke also passed locally through the privileged/non-root wrapper before Docker Desktop later developed an unrelated BuildKit storage I/O fault.

Follow-up required for Slack live environment

The code path is repaired, but the current environment still needs a one-time Slack reconnect because its existing refresh handle is already stale, plus a fine-grained LOCALITY_SECRET_ROTATOR_TOKEN environment secret permitted to update Actions environment secrets.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 7, 2026 12:43am

[github-actions]

Codex review

No high-confidence issues found.