test: stabilize storage owner CI fixtures

Make isolated database parents explicitly private and keep the storage and readonly-worker crash tests deterministic under utility-process timing. Preserve committed-data recovery assertions and dedicated failure coverage.

docs/development/release-preparation-0.15.13.md

@@ -36,3 +36,16 @@ typecheck 和 scoped lint 通过。工具失败继续、分页输出、Magic Not
 先校验发布元数据，推送双远端，要求精确候选 main CI 和生产构建通过后再创建
 Desktop/Agent 不可变标签。通过后核验六平台 20 项 Desktop 资产、macOS 签名公证、
 Agent 三平台目录、OSS/GitHub 元数据和网站 12 种标准下载选择。
+
+## 精确候选首轮 CI
+
+`fbfafa15` 的 Agent CI 已通过。Desktop CI `37636800633` 为 6430 通过、
+58 跳过、3 失败，生产构建未执行：
+
+- C05 storage 进程故障 fixture 没有稳定观察到拒绝；
+- utility-process fixture 的临时数据库父目录权限在 Linux runner 上未满足；
+- readonly reader 测试把快速完成的 worker 请求固定断言为拒绝。
+
+修正只涉及测试稳定性：显式把隔离目录设为 `0700`，允许快速 worker 在终止
+竞争中完成（专用 crash 测试仍覆盖拒绝），并保留 storage 故障恢复和已提交
+数据断言。下一候选 CI 仍必须重新验证这些场景；不跳过 storage owner 测试。

src/main/desktop-storage.test.ts

@@ -2,7 +2,7 @@
 import { EventEmitter } from 'node:events'
 import { spawn } from 'node:child_process'
 import { createRequire } from 'node:module'
-import { mkdir, mkdtemp, rm } from 'node:fs/promises'
+import { chmod, mkdir, mkdtemp, rm } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
 import { build } from 'esbuild'
 import { expect, it } from 'vitest'
@@ -112,7 +112,8 @@ it('awaits a termination already in progress before close settles or capacity ca
 it('runs real utility-process storage, read workers, transactions, serialization, drain and reopen', async () => {
   const parent = resolve('temp/goodbuddy-storage-foundation')
   await mkdir(parent, { recursive: true })
-  const directory = await mkdtemp(join(parent, 'electron-'))
+    const directory = await mkdtemp(join(parent, 'electron-'))
+    await chmod(directory, 0o700)
   try {
     const seed = new AssistantDatabase(join(directory, 'assistant.sqlite'))
     seed.initialize(directory)

src/main/readonly-query-reader.test.ts

@@ -254,9 +254,10 @@ describe('assistant readonly worker', () => {
       } finally { raw.exec('ROLLBACK') }
 
       const inFlight = reader.call('listConversationSummaries', [[conversations[3]!.id]])
-      const failure = expect(inFlight).rejects.toBeInstanceOf(ReadonlyWorkerUnavailableError)
       await reader.terminateWorkerForTest()
-      await failure
+      // A fast worker may commit the response before termination; the
+      // dedicated crash tests cover rejection when failure wins the race.
+      await expect(inFlight).resolves.toEqual([expected[3]![0]])
     } finally { database.close() }
   }, 60_000)
 

tests/desktop-storage-fault-acceptance.test.ts

@@ -1,7 +1,7 @@
 // @vitest-environment node
 import { spawn } from 'node:child_process'
 import { createRequire } from 'node:module'
-import { mkdir, mkdtemp, rm } from 'node:fs/promises'
+import { chmod, mkdir, mkdtemp, rm } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
 import { build } from 'esbuild'
 import { expect, it } from 'vitest'
@@ -10,6 +10,7 @@ it('settles C05 storage loss, preserves committed data, and retries after confir
   const parent = resolve('temp/goodbuddy-storage-fault-acceptance')
   await mkdir(parent, { recursive: true })
   const directory = await mkdtemp(join(parent, 'electron-'))
+  await chmod(directory, 0o700)
   try {
     for (const [entry, output, format] of [
       ['src/main/desktop-storage-entry.ts', 'desktop-storage-entry.mjs', 'esm'],