[EPIC] tests hardening audit (F2 round)

gh issue create --title "[EPIC] tests hardening audit (F2 round)" --label "epic,audit" --body "## EPIC: tests hardening audit (F2 round)

Source: F2 audit round, 2026-09-03. This EPIC aggregates the 17 findings from the tests audit (3 HIGH, 7 MEDIUM, 7 LOW).

The HIGH items are all variants of the apk-add race (#137, #136) plus the max-retries workaround (#138). They have all been opened as issues already; the F2 audit adds detail to them. The MEDIUMs and LOWs are coverage and cleanup hygiene.

### HIGH

- [ ] #137 smoke.sh:81 apk-add race (existing; F2 added 2 more sites)
- [ ] #136 tests/integration/lib/common.sh:280-296 apk-add race (existing; F2 added detail)
- [ ] #138 INPUT_MAX_RETRIES=3 masks flake (existing; F2 added detail, complement to #167)

### MEDIUM

- [ ] #158 chmod 0600 on env-file writes in scenarios 03/04 (existing; F2 added detail)
- [ ] #159 smoke.sh:224 Test 11c passes two env vars as one arg (existing; F2 added 2 more cases)
- [ ] #165 scenarios 03/04/08 skip assets/ subdirectory check (existing; F2 added 05 NULL detail)
- [ ] #223 tests M5 — scenarios can't run in parallel (fixed ports 2121/2122/2123)
- [ ] #224 tests M6 — scenario 09 uses sleep 1 for bind-mount propagation
- [ ] #225 tests M7 — _log files leaked on failure path

### LOW

- [ ] #226 tests L1 — _script files leaked on failure path
- [ ] #227 tests L2 — tests/unit/report.bats:94 has stale '24 declared inputs' comment
- [ ] #228 tests L3 — Makefile:73-75 lint target doesn't cover tests/release-smoke.sh
- [ ] #229 tests L4 — scenario 10 sentinel date hardcoded
- [ ] #230 tests L5 — bats coverage gaps for compute_backoff_seconds and validate_path
- [ ] #231 tests L6 — smoke tests don't cover FTPS (implicit or explicit)
- [ ] #232 tests L7 — scenarios 03/04 missing _log cleanup comment (documentation)

## Suggested resolution order

1. Land H1+H2+H3 fixes (apk-add race + retry classifier) in v2.11.3 alongside the lib.sh CRIT-1 work — the same PR can include M1 (#158 chmod 0600) and M2 (#159 env-var) since they share the test-helper code.
2. Batch M5+M6+M7 (parallel-runner cleanup) into a v2.11.4 follow-up.
3. Batch LOWs into a coverage-cleanup release.

## Source

F2 audit 2026-09-03 (tests audit). Reporter: subagent-pekodbj7."