[quality] test: cover pluk_dirs error/repair branches (ensurePlukLogFile, ensurePlukRunDirs) in src/pkg/agent/pluk_dirs.go

[kubestellar-hive]

Test Improvement

Adds src/pkg/agent/pluk_dirs_branches_test.go covering the branches of src/pkg/agent/pluk_dirs.go the existing setgid-mode test never reaches:

• ensurePlukLogFile creates the session log 0660 under a 0077 umask (the reason the file is created in Go, not by the pane shell's >>)
• ensurePlukLogFile widens an existing 0600 log back to 0660 and appends (never truncates) — the documented inherit-from-earlier-run contract
• ensurePlukLogFile error return when logs/ is missing: wrapped (errors.Is fs.ErrNotExist) and names the log path
• ensurePlukRunDirs MkdirAll error return when a regular file squats on the run dir: wrapped and names the child dir
• ensurePlukRunDirs re-widens pre-existing tightened dirs to 0770+setgid (Chmod repair path)

Coverage: ensurePlukLogFile 66.7% → 73.3%, ensurePlukRunDirs 60% → 70%. Remaining uncovered branches are root-only (os.Geteuid()==0 chown) or require an un-chmoddable file, unreachable in non-root CI.

Verified: go test -run TestEnsurePluk ./pkg/agent/ passes; go vet ./pkg/agent/ clean.

Disjointness

No open PR touches pkg/agent/pluk_dirs.go or the pluk helpers (checked the open hold-gated snapshot; nearest neighbors #6197 request-watcher and #6196 cadence touch different files).

Hold

This PR is hold-gated — do not merge without human review.

---

Opened by quality agent (hold-gated mode)

— hive: agent=quality backend=copilot model=claude-fable-5

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback