fix(wake): #934 mount-free, privilege-invariant seq-integrity fault injection (T9/T11 run in non-priv CI) (#936)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/manifest.txt

@@ -222,8 +222,26 @@
 #              re-enumerates + alarms. Changed: store.sh, reconcile.sh,
 #              _wake-common.sh (doc), test-wake-reconcile.sh (R10/R11),
 #              test-wake-store-ack.sh (T12).
+#   0.6.11 #934 seq-integrity fault injection made MOUNT-FREE + privilege-invariant
+#              so the allocator's most safety-critical failure paths ACTUALLY RUN in
+#              the real NON-privileged CI runner (which denies mount-in-userns) instead
+#              of skipping. T9 (#908 arrow-1 no-burn) and T11 (#917 final-cursor gate +
+#              observed.set rollback) previously forced a write to fail via
+#              `unshare --mount --user --map-root-user` + a bind-mount EBUSY-on-mountpoint,
+#              which the non-priv runner DENIES -> both SKIPPED (skipped-trust-layer, the
+#              class #912 cured for digest). FIX: a single test-only, PROD-INERT fault
+#              seam in _wake-common.sh _atomic_write honored ONLY when the env var
+#              WAKE_TEST_FAULT explicitly names a write point (pending->pending.jsonl,
+#              cursor->observed_seq); it forces the ALREADY-EXISTING fail-loud/rollback
+#              PATH (#908/#917) to be taken for that one target and RUNS UNPRIVILEGED. No
+#              production input can set a process env var, so with it unset the seam is a
+#              no-op: on-disk format + allocator semantics are byte-for-byte unchanged in
+#              production. The unshare+bind-mount injection AND its skip-when-unavailable
+#              guard/witness-marker are REMOVED — T9/T11 now RUN and ASSERT their failure
+#              paths in every environment including non-priv CI. Changed: _wake-common.sh
+#              (seam), test-wake-store-ack.sh (T9/T11 conversion).
 component=wake
-version=0.6.10
+version=0.6.11
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version