ci: capture CloudStorage root permission inventory

[Jesssullivan]

Summary

• capture CloudStorage root stat/access/xattr/domain-list diagnostics when macOS FileProvider smoke fails before enumeration or during expected-file reads
• include those logs in failure-classification-input.log so cloudstorage_root_permission_denied packets explain both FileProvider and POSIX-side state
• extend the shell regression test to prove the new inventory is archived on root EPERM classification

Why

The latest production FileProvider smoke narrowed TIN-1547 to a persistent PZM CloudStorage root EPERM: fileproviderctl evaluate/check can see the root, but the runner process cannot ls or find it. The existing classifier identified the class correctly but did not preserve enough root permission state to distinguish ACL/flags/TCC/runner-state causes on the next run.

Validation

• bash scripts/test-macos-postinstall-smoke.sh
• bash -n scripts/macos-postinstall-smoke.sh scripts/test-macos-postinstall-smoke.sh
• git diff --check