Scope private helper checks and retain audit retry diagnostics

Bind the new 0600 assertion only to the reviewed temperature cleanup helper rather than impose it on the unchanged public Unified Agent installer recipe. Include the captured canned audit output when its existing one-call assertion fails, preserving verdicts, call counts and timing controls. The complete second proof retains its fail-closed two-call observation without a cause or successful-retry claim.

Contract-Neutral: Test adapter scope and failure diagnostics only; existing guide, audit verdict and timing contracts are unchanged.
Change-source: pulse-maintainer

scripts/tests/test_agent_docs.py

@@ -173,7 +173,8 @@ class AgentDocsTest(unittest.TestCase):
                             self.assertEqual(result.returncode, expected, result.stderr.decode())
                             if expected == 0:
                                 self.assertEqual((home / ".config/pulse" / output).read_bytes(), b"# harmless installer fixture\n")
-                                self.assertEqual(stat.S_IMODE((home / ".config/pulse" / output).stat().st_mode), 0o600)
+                                if name == NAMES[1]:
+                                    self.assertEqual(stat.S_IMODE((home / ".config/pulse" / output).stat().st_mode), 0o600)
                             elif name == NAMES[1]:
                                 self.assertFalse((home / ".config/pulse" / output).exists(),
                                                  "a failed temporary download must not become the cleanup helper")

scripts/tests/test_npm_audit_retry.py

@@ -206,7 +206,7 @@ class NpmAuditRetryTest(unittest.TestCase):
             with self.subTest(require=require):
                 result, calls = self.run_check("vulnerability", "all", require=require)
                 self.assertEqual(result.returncode, 1, result.stdout)
-                self.assertEqual(calls, ["audit --json"])
+                self.assertEqual(calls, ["audit --json"], result.stdout + result.stderr)
                 self.assertIn("::error::", result.stdout)
                 self.assertNotIn("::warning::", result.stdout)