test: re-stamp the Windows build-dir DACL at the serial-tail boundary

On one dry run the two arm shards split: the shard whose serial tail
held the install-flow suites failed the source-directory policy minutes
after its pre-wave stamp, while its sibling — same runner image, same
stamp — passed with no install-flow suites to notice. Wave suites spawn
Cygwin-family tooling that can rewrite the build directory's DACL
behind the first stamp, so the stamp is now a function invoked both
pre-wave and at the tail boundary, where the deadline-sensitive suites
that depend on it actually run. Both invocations self-verify out loud.

Verified on the VM from a deliberately reset (inherited) build
directory through the real --par path: both stamps report clean, mini
shard green.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

scripts/run-tests-parallel.sh

@@ -48,27 +48,32 @@ mkdir -p "$LOGDIR"
 # setup. Two idempotent steps: protect the DIRECTORY (inheritance flags are
 # directory-only — a /T re-root leaves files with empty deny-all DACLs),
 # then /reset the children to re-inherit the clean set.
-case "$(uname -s 2>/dev/null)" in
-MINGW* | MSYS*)
+stamp_windows_build_dir() {
+    local when="$1"
+    case "$(uname -s 2>/dev/null)" in
+    MINGW* | MSYS*) ;;
+    *) return 0 ;;
+    esac
+    local runner_dir_w me stamp_out reset_out
     runner_dir_w="$(cygpath -w "$(dirname "$RUNNER")")"
     me="$(whoami | tr -d '\r')"
     stamp_out=$(MSYS2_ARG_CONV_EXCL='*' icacls "$runner_dir_w" /inheritance:r \
         /grant:r "${me}:(OI)(CI)F" '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' \
-        /Q 2>&1) || echo "WARN: build-dir DACL stamp failed (user=$me dir=$runner_dir_w): $stamp_out"
+        /Q 2>&1) || echo "WARN: build-dir DACL stamp ($when) failed (user=$me dir=$runner_dir_w): $stamp_out"
     reset_out=$(MSYS2_ARG_CONV_EXCL='*' icacls "${runner_dir_w}\\*" /reset /T /C /Q 2>&1) ||
-        echo "WARN: build-dir child DACL reset failed: $(printf '%s' "$reset_out" | tail -2)"
+        echo "WARN: build-dir child DACL reset ($when) failed: $(printf '%s' "$reset_out" | tail -2)"
     # The stamp is load-bearing for the install-flow suites: verify it and say
     # so, in either direction — a silent stamp once cost a full CI round to
     # even see WHETHER it had run.
     if MSYS2_ARG_CONV_EXCL='*' icacls "$runner_dir_w" 2>/dev/null |
         grep -qE 'Authenticated Users|CREATOR OWNER'; then
-        echo "WARN: build-dir DACL still grants cross-account mutation after stamp:"
+        echo "WARN: build-dir DACL still grants cross-account mutation after $when stamp:"
         MSYS2_ARG_CONV_EXCL='*' icacls "$runner_dir_w" 2>&1 | head -8
     else
-        echo "build-dir DACL stamped clean ($runner_dir_w, user=$me)"
+        echo "build-dir DACL stamped clean ($when, $runner_dir_w, user=$me)"
     fi
-    ;;
-esac
+}
+stamp_windows_build_dir pre-wave
 
 SUITES_FILE="$LOGDIR/suites.txt"
 RESULTS_FILE="$LOGDIR/results.txt"
@@ -243,6 +248,13 @@ while IFS= read -r sname; do
         echo "$sname" >> "$FLEX_FILE"
     fi
 done < "$SER_FILE"
+# Wave suites spawn Cygwin-family tooling that can rewrite the build
+# directory's DACL behind the first stamp (observed: an arm shard whose
+# tail held the install-flow suites failed the source-directory policy
+# minutes after a clean pre-wave stamp, while its sibling shard passed).
+# Re-stamp at the tail boundary so the deadline-sensitive tail — which
+# hosts those suites — always starts from the verified-clean shape.
+stamp_windows_build_dir pre-tail
 xargs -P "${CBM_TAIL_JOBS:-2}" -I{} bash -c 'run_one "$@"' _ {} < "$FLEX_FILE"
 while IFS= read -r sname; do
     run_one "$sname"