[fix] keyman: a permission-based test the CI runner is root for

The snapshot run for 0.7.0 failed on this one test and published nothing.
`scanPrivateKeys` classifies a file it cannot open as not-a-key, and the test
made the file unopenable with `chmod 0o000` — which stops nobody with uid 0,
and Gitea's act_runner is a container running as root. So the file was read,
recognised as a private key not named id_*, and reported as skipped.

A dangling symlink instead: ENOENT is not a permission anyone can override,
and it is a realistic ~/.ssh inhabitant. Verified by running the gate in a
node:22 container as root, where the whole workspace is now green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/keyman/tests/keys.test.ts

@@ -73,14 +73,14 @@ describe('scanPrivateKeys', () => {
     expect(scanPrivateKeys(dir)).toEqual({ keys: [], skipped: [] });
   });
 
-  it('ignores a file it cannot read', () => {
-    write('secret', OPENSSH);
-    fs.chmodSync(path.join(dir, 'secret'), 0o000);
+  it('ignores a path it cannot read', () => {
+    // A dangling symlink, not a 0o000 file: root reads a 0o000 file happily, so
+    // the mode-based version of this passed here and failed on the CI runner,
+    // which is a container running as root. ENOENT nobody can override.
+    fs.symlinkSync(path.join(dir, 'gone'), path.join(dir, 'secret'));
 
     // Reported as not-a-key rather than crashing the menu it was building.
     expect(scanPrivateKeys(dir).skipped).toEqual([]);
-
-    fs.chmodSync(path.join(dir, 'secret'), 0o600);
   });
 
   it('does not read past the header', () => {