test(ci): classify Bubblewrap EPERM exactly

scripts/gate-history.test.mjs

@@ -16,7 +16,12 @@ const fixtureRoot = path.join(process.cwd(), '.mosaic-test-work', `gate-history-
 
 function sandboxUnavailable(result) {
   const detail = `${result.stdout ?? ''}${result.stderr ?? ''}${result.error?.message ?? ''}`;
-  if (!/bwrap:.*(?:Operation not permitted|Creating new namespace failed)/i.test(detail)) {
+  const bubblewrapSpawnDenied =
+    result.error?.code === 'EPERM' && /spawnSync bwrap/i.test(result.error?.message ?? '');
+  if (
+    !bubblewrapSpawnDenied &&
+    !/bwrap.*(?:EPERM|Operation not permitted|Creating new namespace failed)/i.test(detail)
+  ) {
     return false;
   }
   assert.notEqual(result.status, 0, 'sandbox unavailability must remain terminal nonzero');
@@ -44,6 +49,23 @@ test.after(async () => {
   await rm(fixtureRoot, { recursive: true, force: true });
 });
 
+test('sandbox refusal classification requires Bubblewrap provenance', () => {
+  assert.equal(
+    sandboxUnavailable({
+      status: null,
+      error: { code: 'EPERM', message: 'spawnSync bwrap EPERM' },
+    }),
+    true,
+  );
+  assert.equal(
+    sandboxUnavailable({
+      status: null,
+      error: { code: 'EPERM', message: 'spawnSync git EPERM' },
+    }),
+    false,
+  );
+});
+
 test('prospective history reads each commit own manifest rather than the current tree', async () => {
   await rm(fixtureRoot, { recursive: true, force: true });
   await mkdir(fixtureRoot, { recursive: true });