fix(control)+test: terminal status on every control_apply exit; pin five failure paths

[VijitSingh97]

Implements all five items of #276 (2026-07 repo-scan test-gap pass). One real code fix (item 1b); the rest are tests pinning previously untested failure/wiring paths.

Item 1 — control_apply rollback double-failure + unreadable backup (code fix + tests)

1(b) code fix (rigforge.sh, control_apply): the rollback's cp "$backup" "$CONFIG_JSON" was unguarded — an unreadable backup ERR-trapped the oneshot out under set -Eeuo pipefail with NO status written, so the receiver kept serving the stale previous outcome forever. The cp is now explicitly guarded: on failure the applier writes a terminal failed status with reason rollback backup unreadable: <path> and returns 0.

1(a) contract pin: the rollback re-apply's own success/failure is now distinguishable in the rolled_back reason string — ...; rolled back and live vs ...; rollback re-apply also failed to restore liveness — so a dashboard can tell a self-healed rig from one still down.

Tests extend the existing ca_run harness: a call-counting _wait_miner_live stub (CA_ROLLBACK_OK drives the 2nd call, defaulting to CA_APPLY_OK so all pre-existing cases are unchanged) plus a CA_BACKUP_UNREADABLE hook that swaps the backup file for a directory (robust even when the suite runs as root under kcov, where chmod 000 wouldn't bite).

Item 2 — tune abort restarts the stopped miner (test)

Black-box tune with a fake xmrig that exits nonzero without a hashrate line on candidate 2 (single-knob prefetch sweep makes candidate 2 deterministic). Asserts the Restarting the 'xmrig' service log line AND the recorded [systemctl] start xmrig shim call — pinning the _tune_bench_cleanup EXIT trap on the crash path, not just the happy path.

Item 3 — apply → _stamp_config_meta local wiring (test)

After the existing black-box apply run, assert .rigforge-config-meta.json exists with "source": "local". Previously every #254 test drove the helper directly, so deleting the call site in apply passed the whole suite while fleet provenance silently froze.

Item 4 — changes/ index keep-20 prune (test)

Loop _control_status through 22 distinct change_ids (the two oldest separated by real mtime gaps); assert exactly 20 files remain, both oldest are gone, and survivors 3 and 22 are present.

Item 5 — api_refresh partial-failure atomicity (test)

Stub _api_rigforge_block to emit a block whose health is a string (so only health.json's own jq '.health + {...}' extraction fails); assert the previous health.json content still serves while summary.json and tune.json still updated — pinning the per-file printf | jq && mv atomicity so a refactor to a single non-atomic write goes red.

Verification

• make test (lint + suite): 1371 passed, 0 failed after rebasing onto latest develop.
• Red-checks (each run against the full suite):
  • control_apply fix reverted → 4 failures (both item-1 reason pins + the failed status + its reason).
  • _stamp_config_meta call in apply() neutralized → 2 failures.
  • keep-20 prune line neutralized → 3 failures.

Closes #276

🤖 Generated with Claude Code