EACCES on a descriptor re-open is recorded as a permanent unreadable verdict

An `EACCES` when a tool re-opens a descriptor by path is recorded as a permanent verdict against the caller's file.

`Descriptor#fd_path` hands a tool `/dev/fd/N`. Opening that path is a fresh open, re-checked against the opening process's uid. When the app and the cell run as different uids, every such open fails with `EACCES`.

Two paths then turn that into `unreadable`, which is permanent:

- `ToolOperation#run!` maps any non-zero exit to `UnreadableDocument`, which descends from `HotCell::UnreadableInput`.
- `VipsOperation` declares `unreadable Vips::Error`, and `analyzers/image/vips.rb` opens `source.fd_path` in the worker itself, so the in-process path does the same.

A bare `Errno::EACCES` on its own answers `failed`, which is transient — confirmed against a containerized cell. So the raw error is classified correctly. The permanent verdict comes only from those two mappings.

This is an environment fault. It is identical for every file, and it is fixed by a configuration change. A tool that cannot open its input has said nothing about the input.

On the analyzer path the misclassification is durable. Per `docs/TUNING.md`, `Analyzers::Analyzing#metadata` rescues the permanent class and returns `{}`, Rails merges `analyzed: true`, and nothing re-enqueues `AnalyzeJob`. Every image analyzed during the broken window is recorded as analyzed with no dimensions, permanently.

Fix shape: detect the failure where the descriptor becomes a path, rather than in each operation, and raise a non-permanent error. That is one place instead of seven, and it turns a silent permanent verdict into a loud configuration fault.

Found while installing a cell in fizzy staging, alongside the uid-mismatch bug that the shared group (5477d3c3) fixed. Previously tracked as Fizzy card #377.

Start at Descriptor#fd_path and trace how a path reopen handles EACCES, then inspect ToolOperation#run!, VipsOperation, and analyzers/image/vips.rb. Check docs/TUNING.md for the permanent-error handling and verify that descriptor permission failures become non-permanent rather than producing durable unreadable or analyzed-without-metadata results.

Written by the indexing model from the issue text.