test(ci): keep cache dir traversable so restore verification can read files

Previous run proved the round-trip works (50.06MB saved → 50.06MB
restored, exact match) but the assertion failed because chmod -R 0600
stripped the directory's execute bit, locking the runner out of its
own restored files. Real container caches have 0755 dirs. Keep the dir
0755, only the files 0600 root-owned.

Author: mridang

.github/workflows/verify-cache.yml

@@ -20,11 +20,16 @@ jobs:
           sudo mkdir -p "$D"
           echo "secret-from-root-$(date +%s%N)" | sudo tee "$D/marker.txt" > /dev/null
           sudo dd if=/dev/urandom of="$D/blob.bin" bs=1M count=50 status=none
-          sudo chmod -R 0600 "$D"
           sudo chown -R root:root "$D"
+          # Directory stays traversable (0755) — like a real container-
+          # written cache dir. Files are 0600 root-owned so the runner
+          # genuinely cannot read their contents at save time.
+          sudo chmod 0755 "$D"
+          sudo chmod 0600 "$D/marker.txt" "$D/blob.bin"
           echo "=== planted (measured as root) ==="
           sudo du -sh "$D"
-          echo "=== runner trying to read marker (should be denied) ==="
+          echo "=== runner can list the dir but not read the file ==="
+          ls -la "$D"
           cat "$D/marker.txt" 2>&1 || echo "expected: permission denied"
       # The action's post-step runs here and saves ~/.cache via sudo tar.