Make store prune fail closed on incomplete index scans

[TyceHerrman]

store prune builds its keep-set from cached package indexes. In the current scan, errors while listing directories, reading entries or files, and parsing JSON are skipped. Pruning then continues with whatever hashes were collected successfully. Because files missing from that set become prune candidates, a skipped index is effectively treated as an index with no references.

I reproduced with a synthetic 14-byte file placed in Aube's store layout and a package index that referenced it. With a valid index, the file was kept:

reported files pruned: 0
fixture file after prune: present (14 bytes)

After replacing that index with malformed JSON, the same command exited successfully and deleted the file:

reported files pruned: 1
exit code: 0
fixture file after prune: missing

seems like store prune should require a complete, error-free index scan before deleting any store files. if so, both a real prune and --dry-run should return an error naming the affected path if an existing index directory cannot be listed or an index file cannot be read or parsed and no files should be deleted if there's a scan error.

I think malformed JSON should block pruning rather than implicitly invalidate that package index. Repairing or deliberately removing a bad index can be a separate action

This matters most on APFS and btrfs, where link counts do not reveal reflinked copies and the cached indexes are the remaining keep-set. Tests could cover malformed JSON, unreadable files and directories, dry-run using the same scan, and a failure encountered after valid indexes have already been scanned. Each case should exit nonzero and leave every store file in place.

PR #365 previously made pruning abort when its SQLite index could not be read. That implementation was later reverted, and PR #372 closed without merging. This asks for the same guard in the current JSON scanner, without bringing back SQLite.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5.6 Sol

[jdx]

Confirmed and fixed in PR #1237: #1237

The JSON index walk now fails closed on directory listing, directory-entry, metadata, file-read, and JSON parse errors. Both a real prune and --dry-run complete the strict scan before examining any CAS files, and diagnostics include ERR_AUBE_STORE_INDEX_SCAN_FAILED plus the affected path.

I also routed store status through the same scanner so malformed or unreadable indexes can no longer be reported as a consistent store.

Regression coverage verifies malformed JSON and unreadable files/directories, checks both prune modes, and asserts that every store file remains in place. cargo test, full clippy, formatting, and test/store.bats pass.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.