Add an sshfs backend to eval-under

[yarikoptic]

Split out of #5, which had grown too large to review as one change. This is the sshfs backend on its own, on top of current master; #5 keeps the probing / capabilities / survey work and has dropped its sshfs wiring.

Why sshfs

It is what people actually reach for to mount a remote over ssh, and it breaks git in a way no local filesystem does. SFTP's ATTRS carries no inode number and no link count, so sshfs synthesises st_ino per path and reports nlink=1. Callers that hardlink and then verify the link cannot see that it happened, and they fail.

Two such callers, both measured here against an ext4 control:

	sshfs default	sshfs -o disable_hardlink	ext4
git annex add (locked)	ok	ok	ok
git annex add, annex.addunlocked=true	failed to link to annex	ok	ok
git clone <local path>	fatal: hardlink different from source	ok	ok

Plain git clone of a local path does not work on sshfs at all — builtin/clone.c hardlinks each object and compares st_mode/st_ino/st_dev/st_size/st_uid/st_gid against the source. That is broader than the git-annex failure and the same mechanism.

-o disable_hardlink fixes both, which is the counter-intuitive part worth telling a reporter: sshfs then fails link() with EPERM instead of pretending, and both git and git-annex have copy fallbacks that only an honest failure reaches. A filesystem advertising hardlinks it cannot express is worse than one admitting it has none.

What's here

bin/eval-under-sshfs, in two modes:

• Loopback (default): a throwaway sshd on the first free port at or above 2222 — its own host key, authorized_keys and pid file inside the run's scratch directory — with a fresh backing directory sshfs-mounted back over it. The system sshd is not used and ~/.ssh/authorized_keys is never written to.
• --host: mounts a real remote using the caller's ssh config, so a reporter's own server and mount options can be used verbatim.

Flags for the options reports actually turn on: --no-cache, --workaround, --opt, --port, --user, --remote-dir, plus the common --mount-point / --set-home / --keep.

Wiring: install-backend.sh grows an install_sshfs, and run-under.sh grows the backend case plus a refusal — sshfs together with a root-requiring target exits 2 rather than producing a meaningless red result.

In the matrix: two cells, not four

The matrix goes from 20 cells to 22 — sshfs (loopback) / git-annex test and sshfs (loopback) / git testsuite. Both are red, both for the reasons above, and both are annotated as expected on the report page and in GOTCHAS.md.

Not four. stress-ng and pjdfstest are needs-root, and a FUSE mount belongs to whoever mounted it, so those cells could only report on privilege rather than on the filesystem.

Rather than a hand-kept exclusion list, the backend row carries no-root: true and cell_enabled() in matrix.sh derives the gap from that plus the target's existing needs-root. The reason lives in one place, a future unprivileged backend gets the behaviour for free, and the grid cannot silently grow a cell that measures privilege. Every consumer asks cell_enabled instead of assuming backends × targets:

consumer	behaviour for a non-cell
matrix-json.sh	omits it, so the workflow never schedules it
gen-readme-matrix.sh	prints n/a instead of a badge (README regenerated)
update-status.py	keeps it out of status.json — no permanently-unknown badge
render-report.py	renders an explicit gap, not an "unknown" badge that would read as "not measured yet"

A reporting bug this turned up

not ok N ... # TODO known breakage is git's test_expect_failure — a TAP TODO directive that prove counts as an expected result, not a failure. dump-failure-logs.sh counted those, so the sshfs git cell reported 351 failed assertions where prove saw ~170, and the two worst-looking scripts (t1517-outside-repo at 104, t0450-txt-doc-vs-help at 54) are ones prove reports as ok — triage aimed at failures that do not exist. This inflated every git cell, vfat included. Both the count and the detail listing now exclude the directive; the same cell reports 179 after the fix.

Two non-obvious pieces in the backend

• Dropping privileges calls sudo -u literally rather than going through the ${SUDO[@]} array the other backends use. That array is empty when we are already root, which is exactly the case that needs the drop — routing through it made the documented sudo bin/eval-under sshfs invocation fail with -u: command not found.
• sshd runs with UsePAM yes. With it off, sshd refuses any account whose shadow entry is locked (!) — the normal state for service and CI accounts — and the mount fails for a reason that looks nothing like its cause. Its log is dumped on mount failure for the same reason.

Verification

• bin/ci/run-checks.sh: shellcheck clean, 28/28 bats — including the four "every installed backend" cases, which now cover this backend.
• Mount exercised as root and through the privilege-drop path (mounted and ran as an unprivileged user), reproducing nlink=1 with distinct synthesised inodes for two names of one file.
• The git cell was characterised by building the pinned git v2.55.0 and running the whole t0*/t1* range under the backend (174 scripts, 10366 assertions) plus an ext4 control that passes; the clone failure was then reproduced minimally. One hypothesis was tested and rejected rather than left implied: synthesised inode numbers do not collide at 4000 entries.
• All 22 cells reported on the run before the docs commit: the 20 pre-existing ones match master's published baseline cell-for-cell, both sshfs cells are red as described, and sshfs-stress-ng / sshfs-pjdfstest are absent as the no-root rule intends.
• GOTCHAS.md names the small failures that are not explained (t0003-attributes 6, t1091 8, t0610 3, t0021 3, ten scripts with one each), so nobody assumes they share a cause.

Note for whoever merges second

#5 also touches update-status.py and render-report.py (to filter its on-demand capabilities target), in the same enumeration this PR changes. Expect a small conflict in those two files for whichever of #5 / #13 lands second; both changes are additive filters on the same loop and compose cleanly.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E1fDiGVWKywpbhVps5hzQK