fix(installer): fail closed on test enumeration errors

tools/test-enumeration-assertions.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Fail-closed filesystem-enumeration assertions for shell test harnesses.
+
+# Usage: test_assert_find_empty <label> <find arguments...>
+test_assert_find_empty() {
+  local label="$1"
+  shift
+  local inventory
+
+  inventory="$(mktemp "${TMPDIR:-/tmp}/mosaic-test-find.XXXXXX")" || {
+    printf '[test] ERROR: %s inventory allocation failed\n' "$label" >&2
+    return 2
+  }
+
+  if ! find "$@" -print0 > "$inventory"; then
+    rm -f "$inventory"
+    printf '[test] ERROR: %s enumeration failed\n' "$label" >&2
+    return 2
+  fi
+
+  if [[ -s "$inventory" ]]; then
+    rm -f "$inventory"
+    printf '[test] FAIL: %s was not empty\n' "$label" >&2
+    return 1
+  fi
+
+  rm -f "$inventory"
+  return 0
+}
+
+# Usage: test_assert_no_file_content_match <label> <extended-regex> <find roots/options...>
+test_assert_no_file_content_match() {
+  local label="$1"
+  local pattern="$2"
+  shift 2
+  local inventory path grep_status result=0
+
+  inventory="$(mktemp "${TMPDIR:-/tmp}/mosaic-test-find.XXXXXX")" || {
+    printf '[test] ERROR: %s inventory allocation failed\n' "$label" >&2
+    return 2
+  }
+
+  if ! find "$@" -type f -print0 > "$inventory"; then
+    rm -f "$inventory"
+    printf '[test] ERROR: %s enumeration failed\n' "$label" >&2
+    return 2
+  fi
+
+  while IFS= read -r -d '' path; do
+    grep_status=0
+    grep -Eq -- "$pattern" "$path" || grep_status=$?
+    if [[ "$grep_status" -eq 0 ]]; then
+      result=1
+      break
+    fi
+    if [[ "$grep_status" -ne 1 ]]; then
+      result=2
+      break
+    fi
+  done < "$inventory"
+
+  rm -f "$inventory"
+  if [[ "$result" -eq 1 ]]; then
+    printf '[test] FAIL: %s contained a forbidden match\n' "$label" >&2
+    return 1
+  fi
+  if [[ "$result" -eq 2 ]]; then
+    printf '[test] ERROR: %s content inspection failed\n' "$label" >&2
+    return 2
+  fi
+  return 0
+}