fix(tests): install-journey harness asserts nothing — guard() swallows failures + path-persist has no signal

[saadqbal]

Post-merge review of #214 (by @aptracebloc) surfaced real defects in the install-journey test harness. All verified against the code on develop.

Critical

• guard() in scripts/tests/e2e-journey.sh captures local rc=$? inside the then branch of if ! timeout ..., so rc is the negated status (always 0). Every assertion runs under guard, so set -e never trips and the job prints E2E JOURNEY PASS even when steps fail or hang. Reproduced empirically (exit 3 and a 124 hang both return 0). Leg 2 asserts nothing today.

High

• scripts/tests/path-persist.sh assert_cell uses bash -c/zsh -c for the "nonlogin" cell. Non-interactive shells read no rc files (verified: only bash -ic reads .bashrc), so the "customer opens a new terminal" case is never reproduced.
• Container runs as root → install.sh writes to /usr/local/bin (already on default PATH), so the ~/.local/bin rc-persistence path (the cli#61 class) is never exercised. Cells pass trivially on both pre-fix and fixed installers — the advertised red/green proof cannot happen.

Medium

• No timeout-minutes on the path-persist and e2e-journey jobs in .github/workflows/installer-tests.yaml (every other job has one).
• pull_request trigger uses default types, so adding the e2e label does not start a run until the next push. Needs types: [..., labeled].

Low (docs drift)

• PR test: cross-repo fresh-shell last-mile E2E harness (install -> CLI -> cluster info -> push) #214 body is stale vs. merged code (default TRACEBLOC_CLI_REF, "nightly" is actually weekly + every push).

Plan

1. Fix guard() (one line) + add a negative-control assertion so the class cannot regress silently.
2. Rework path-persist to use interactive shells and a non-root / non-default-prefix cell so it can distinguish installers.
3. Add timeout-minutes to both jobs; add labeled to the PR trigger types.

Follow-up to #214.

[saadqbal]

PR #311 lands the solidly-correct half: the guard() fix + negative-control self-test (Critical) and the two CI-config fixes (Medium). Keeping this ticket open for the remaining 🟠 High — path-persist has no red/green signal — which is a genuine rewrite, not a one-liner.

Precise contract I confirmed against cli scripts/install.sh (branch ux/cli-surface-and-namespace-discovery):

• Default INSTALL_PREFIX=/usr/local/bin; falls back to $HOME/.local/bin if not writable; overridable via --prefix / INSTALL_PREFIX.
• PATH is persisted only when $PREFIX is under $HOME or not already on $PATH — so the default /usr/local/bin (what root gets) persists nothing.
• When it does persist, it writes to exactly one rc file, chosen by $SHELL: zsh→~/.zshrc, Linux bash→~/.bashrc, fish→~/.config/fish/config.fish, else ~/.profile.

Consequences for the current path-persist.sh:

1. Container runs as root → install → /usr/local/bin (on PATH) → the persistence path is never exercised; every cell passes trivially on both pre-fix and fixed installers. No signal.
2. The login × nonlogin matrix uses bash -c / zsh -c (non-interactive), which read no rc files — they don't reproduce "customer opens a new terminal" (interactive) at all.
3. The installer targets the invoking $SHELL's single rc, so a multi-shell "all resolve" assertion can't hold from one install anyway.

Correct rewrite:

• Force INSTALL_PREFIX=$HOME/.local/bin (a $HOME dir off the default PATH) so the persistence path runs even as root.
• Install once per shell, setting SHELL to each of bash/zsh/fish present, so the installer writes that shell's rc.
• Assert from a fresh interactive shell of that kind (bash -ic, zsh -ic, fish -ic) — matching the rc the installer actually wrote — dropping the meaningless login dimension.
• Include a negative control (point at a known pre-fix installer ref, confirm the cell goes red).

Deferred out of #311 because it can only be validated in CI across the 9-distro matrix (real cli binary download + per-distro shell installs) — not locally.