Review fixes for the embedded Postgres template cache:
- The cache root is `$TMPDIR/paperclip-embedded-postgres-templates-<uid>`,
created 0700. The root and each template are used only when `lstat` shows a
real directory owned by the current user with no group or world write bit;
anything else (symlink, foreign owner, wide mode) is left alone and the
process uses fresh clusters. A template is a Postgres data directory whose
configuration executes on start, so a shared `/tmp` must not feed it.
- Resolving the template never rejects. A failed build or root check resolves
null with one warning, and the support probe then runs the throwaway
cluster, so a migration that cannot apply fails the suite on the fresh path
instead of turning into `supported: false` and `describe.skip`.
- Every reuse refreshes the template's mtime, so the seven-day prune measures
idle time. A template that vanished after this process resolved it is not
retried: the copy loop checks it first, the suite falls back, and the
fallback forgets the path so the next caller rebuilds.
- The template-path test enables the cache for itself and restores the
original PAPERCLIP_TEST_POSTGRES_TEMPLATE value, so the suite also passes
with the bypass set.
- Eight new tests cover the usability checks, a world-writable and a
symlinked root, the mtime refresh, the rebuild after pruning, and the
fall-through from a failed template build to the fresh probe.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>