ci: check directories, not files, under \$HOME/.pkgx

The diagnostic ::warning:: annotations from ea4dab6 confirmed the
install actually works: hyperfine landed under
/home/runner/.pkgx/crates.io/hyperfine/v1.20.0/ with the privilege drop
and HOME override both firing as intended (no "is not reachable as
<user>" diagnostic on pkgm's stderr, only deno download lines).

The remaining failure was the assertion itself: `find -type f -newer
marker` returns empty because tar -x preserves the archive's original
mtimes on extracted files, so the binary's mtime predates the marker.
Only the directories pkgx mkdirs during extraction have a current
mtime.

Switch the positive check to `-type d` and drop the diagnostic
warnings now that the failure mode is identified.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tannevaled

.github/workflows/ci.yml

@@ -123,48 +123,35 @@ jobs:
 
       - name: sudo install drops privileges and overrides HOME
         run: |
-          set -ux
-          # marker to scope checks to files created by this install
+          set -eux
+          # marker to scope checks to entries created by this install
           touch /tmp/pkgm-sudo-marker
-          # Run pkgm with PKGM_DEBUG so the "is not reachable as $USER"
-          # diagnostic surfaces when pkgx_reachable_as falls through; we
-          # tee stderr so the diagnostic is visible in the job log as well
-          # as captured for the warning emission below.
-          sudo PKGM_DEBUG=1 ./pkgm.ts i hyperfine 2> >(tee /tmp/pkgm-sudo.stderr >&2)
-          rc=$?
-          set -e
-          test $rc -eq 0
+          sudo ./pkgm.ts i hyperfine
           test -x /usr/local/bin/hyperfine
 
-          # Surface enough state as ::warning:: annotations to diagnose
-          # which branch query_pkgx() took. Failure cases:
-          #  - "pkgx_reachable_as returned undefined" → privilege drop
-          #    skipped → pkgx runs as root with HOME=/root → cache lands
-          #    under /root/.pkgx, none under $HOME/.pkgx.
-          #  - "user_home() failed" → reachable_as falls through to its
-          #    /home/<user>/ rejection regex.
-          echo "::warning::diag pkgx-via-sudo: $(sudo command -v pkgx 2>&1 || echo none)"
-          echo "::warning::diag root-new-files: $(sudo find /root/.pkgx -newer /tmp/pkgm-sudo-marker -print 2>/dev/null | head -8 | tr '\n' '|' || echo none)"
-          echo "::warning::diag user-new-files: $(sudo find $HOME/.pkgx -newer /tmp/pkgm-sudo-marker -print 2>/dev/null | head -8 | tr '\n' '|' || echo none)"
-          echo "::warning::diag pkgm-stderr: $(tr '\n' '|' < /tmp/pkgm-sudo.stderr | head -c 500 || echo none)"
-
-          # HOME override + privilege drop are both validated via the pkg
-          # cache under $HOME/.pkgx. We deliberately do NOT assert that
+          # HOME override + privilege drop are validated via the pkg cache
+          # under $HOME/.pkgx. We deliberately do NOT assert that
           # /root/.pkgx is empty: the shebang's `pkgx --quiet deno^2.1 run …`
           # runs as root before any pkgm.ts code executes, and that outer
           # pkgx caches under $HOME/.pkgx which resolves to /root/.pkgx
           # under sudo. That cache is unavoidable and unrelated to whether
           # pkgm's *inner* pkgx call dropped privileges.
-
-          new_files=$(sudo find "$HOME/.pkgx" -newer /tmp/pkgm-sudo-marker -type f -print 2>/dev/null | head -1 || true)
-          if [ -z "$new_files" ]; then
-            echo "::error::no new files under \$HOME/.pkgx — inner pkgx did not cache to invoking user's tree"
+          #
+          # We check for newly created entries (directories specifically),
+          # not files: tar -x preserves the archive's original mtimes on
+          # extracted files, so file mtimes are typically *older* than the
+          # marker. Directories are created fresh by `mkdir` during
+          # extraction and reliably have a current mtime.
+
+          new_dirs=$(sudo find "$HOME/.pkgx" -newer /tmp/pkgm-sudo-marker -type d -print 2>/dev/null | head -1 || true)
+          if [ -z "$new_dirs" ]; then
+            echo "::error::no new directories under \$HOME/.pkgx — inner pkgx did not cache to invoking user's tree"
             exit 1
           fi
 
           owned_by_root=$(sudo find "$HOME/.pkgx" -newer /tmp/pkgm-sudo-marker -user root -print 2>/dev/null || true)
           if [ -n "$owned_by_root" ]; then
-            echo "::error::pkgx cache files created as root under \$HOME/.pkgx — privilege drop failed:"
+            echo "::error::pkgx cache entries created as root under \$HOME/.pkgx — privilege drop failed:"
             echo "$owned_by_root"
             exit 1
           fi