fix(coverage): make vendored crates readable by the sandbox user

[seonghobae]

Summary

• Fixes the Rust coverage sandbox failure caused by vendored crate files retaining archive mode 0640 after Docker COPY.
• Normalizes /opt/base-rust-dependencies with chmod -R a+rX before the unprivileged sandbox executes Cargo.
• Restores the independent trust-boundary contract so the reviewed opencode-review-dispatch.yml blob is pinned byte-for-byte.

Root cause

Crate archives can contain files at mode 0640. Docker COPY preserves those bits while making root the owner, so the unprivileged sandbox UID cannot read the vendored files and Cargo fails checksum verification with Permission denied.

The production repair was already present at head c64b958b3ba584d5a5818ef46b2623dbf9a80f11, but that workflow edit changed its Git blob from 09bbf818… to 9b689be2… without updating the separate pinned-review contract. That left the PR's own independent trust-boundary test RED.

Exact-head evidence

• Current head: 87d062f4b4b439474ad6eb35d7d22c3d97aae83e
• Current tree: e66d5bce2f521a7bd25edfbe2fc05c7c20f9dd29
• Parent/RED head: c64b958b3ba584d5a5818ef46b2623dbf9a80f11
• Reviewed workflow blob: 9b689be2bcf7e24943e6ed3199ff24eaf0890ce9
• Independent contract pin: 9b689be2bcf7e24943e6ed3199ff24eaf0890ce9
• Ref update used expected_sha=c64b958b3ba584d5a5818ef46b2623dbf9a80f11 with force=false.

Test evidence

• RED on the parent head:
  • test_independent_review_agent_workflow_matches_reviewed_blob failed because expected 09bbf818… did not equal actual 9b689be2….
• Focused GREEN: 1 passed.
• All 29 contract files that reference opencode-review-dispatch.yml:
  • normal environment: 884 passed, 3 skipped
  • GITHUB_ACTIONS=true: 884 passed, 3 skipped
• Repository suite: 5156 passed, 11 skipped, 2 deselected, 40 subtests passed.
  • The two deselections are fixed-date freshness failures reproduced unchanged on the clean parent and are unrelated to this PR.
• git diff --check: clean.
• Remote ref was fetched after publication; only the one-line independent blob pin changed after the parent head.

Merge posture

Draft / HOLD. Do not merge until:

• hosted coverage-evidence succeeds on exact head 87d062f4b4b439474ad6eb35d7d22c3d97aae83e;
• required review is completed with no unresolved substantive thread;
• branch protection accepts exact-current-head evidence.

No bypass is requested or justified.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}