Merge #614: skip unreadableFileIsUnknown honestly when root ignores the read bit

CI has been red on main itself since #602/#606, on this one test, so the build has been giving no second opinion on any PR. Cause: the CI job runs in a container as root. setReadable(false) really does clear the read bit, so the test's own setup guard passes, but root opens the file anyway and the gauge correctly returns OK. The test was asserting on a condition the environment never created.

The fix adds an assumeFalse(Files.isReadable(file), ...) after the chmod and before the gauge is built, inside the existing try, so the finally still restores the bit on a skip.

Verified by me on a scratch worktree merging this onto 955b9ea:
- 1864 tests, 0 failures, 0 errors, 0 skipped, 149 surefire reports, mvn exit 0. The suite-wide skipped=0 is the point: the fix did not quietly turn the test into a permanent skip.
- LeadContextGaugeTest on this non-root Mac: 9 tests, 0 skipped, and unreadableFileIsUnknown present in the report. The assumption does not fire here, so developers keep the coverage.
- Mutation: made the IOException path return OK instead of UNKNOWN. unreadableFileIsUnknown failed with "expected: <UNKNOWN> but was: <OK>". The test still has teeth. Production file reverted, git diff clean before merge.

Known trade, recorded rather than hidden: under root this case is now covered by nothing at all. A skip is honest about that, which an assertion on an unreachable state was not. The durable fix is to run the CI build as a non-root user; that is a CI configuration change and out of scope here.

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeTest.java

@@ -14,6 +14,7 @@ import java.util.concurrent.atomic.AtomicLong;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeFalse;
 
 /**
  * Ticket "lead context gauge" — fleetd could not see how full a lead's own Claude Code context
@@ -137,6 +138,15 @@ class LeadContextGaugeTest {
         Path file = tmp.resolve("projects").resolve("some-project-slug").resolve(SESSION_ID + ".jsonl");
         assertTrue(file.toFile().setReadable(false), "test setup: must be able to revoke read permission");
         try {
+            // setReadable(false) really did clear the read bit (asserted above), but that alone
+            // does not prove the file is UNREADABLE: running as root (e.g. a CI container) ignores
+            // the read bit and opens the file anyway. Files.isReadable checks what actually happens
+            // on open, not the bit. When it still reports readable, this test cannot create the
+            // condition it needs on this machine, so it skips honestly instead of asserting on a
+            // state that was never reached. A skip here means "I could not set up the case", NOT
+            // "the UNKNOWN behaviour is fine" -- it is not evidence either way.
+            assumeFalse(Files.isReadable(file),
+                    "runs as root (CI container): the read bit does not stop root, so this case cannot be set up here");
             LeadContextGauge gauge = new LeadContextGauge();
             LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
             assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());