Recognise only a native promise from starterPack() and attach the catch
through Promise.prototype.then, so an installed pack's own then or then
getter never runs; such a pack is omitted and logged again instead of
failing the listing. A link count of 0 after the open reports the file
changed, not a hard link. Tests: a throwing then getter, a self-resolving
thenable, and a 0000 file refusing as unreadable.
readSavedTemplate refuses a hard-linked file and an account directory
open to group or other; an open error other than ELOOP reads "can't be
read", not "symlink"; a file that grows during the read has its own
message. installedStarterPacks refuses a promise from starterPack() and
swallows its later rejection. Tests pin each refusal's message, so a
check that a neighbour shadows is still covered.
KINDS gains "starter-pack" (interface 1, export starterPack) with a new
switch "none": namesFor refuses any setting for it with bad-setting, so an
org file can never switch a pack on through plugins.
starter-pack.mjs adds checkPack(doc, {origin}), narrowsTemplate and
widerLines (step 7's line rules), installedStarterPacks (shipped and
installed packs through loadInstalled, origin set; a refused core pack
fails the listing, a refused installed pack is omitted and logged) and
readSavedTemplate (account against ID_PATTERN, name against NAME, then
lstat, no symlink, owner uid, mode 0600 or narrower, 256 KiB checked
before the read, then parseJsonFileText and checkPack with origin saved).
refusals.mjs gains starter-pack-invalid, starter-pack-not-found and
starter-pack-template-changed.
jason.woltje