Flaky shim test: marker file read before the target finishes writing it #29

Problem

On PR #28, CI's test job failed once in TestExec_PTY_CttyAndForegroundPgrp (internal/sessions/shim), even though that PR doesn't touch the shim. The race job passed on the same commit.

pty_darwin_test.go:86: parse marker: unexpected end of JSON input

Root cause

cmd/testtarget writes its -marker file with os.WriteFile, which creates the file (O_TRUNC) and writes it in a separate step. The shim tests' waitForFile returns as soon as os.Stat sees the file. If the test reads between the create and the write, it gets an empty file. Every test that waits for a testtarget marker and then parses it has the same race.

Fix

Have cmd/testtarget write every marker atomically: write a temp file in the same directory, then os.Rename it into place. Readers then only ever see a complete file, and no test-side change is needed.

Write the failing test first: in cmd/testtarget's own tests, or in a small shim test, poll the marker path tightly while the target starts, and assert that every read which finds the file also parses. It should fail within some iterations today.

Contract

• cmd/testtarget/main.go gains func writeFileAtomic(path string, data []byte, perm os.FileMode) error. It creates a temp file in filepath.Dir(path) (a dot-prefixed name from os.CreateTemp), writes, sets perm, closes, and os.Renames over path. On error it removes the temp file.
• Every file testtarget writes for a test to read goes through it: -marker, -signal-marker, -fd3-check, -env-out, -write-outside-result, and writeCallToolResult. The existing error handling stays: -marker and -env-out exit 1 on failure, and the rest ignore errors as they do today.
• -write-outside keeps its plain os.WriteFile. It is the sandbox probe, and its direct create in the target path is the thing being tested.
• No test-side change to waitForFile or its callers.

Tasks and file ownership

• T1 · Repro test first (test-writer): new cmd/testtarget/main_test.go. Build testtarget, spawn it repeatedly with -marker (and a short -sleep), and poll the marker path tightly. Every read that finds the file must parse as JSON with a pid. Also a direct unit test of writeFileAtomic: the content and perm land, and no temp file is left in the directory. [Completed - Verified]
• T2 · Fix (dev): cmd/testtarget/main.go only. [Completed - Verified]