test(albok): sshfs pathname-withdrawal test for the .browse/ view passes (unit 4.3 exposure gate)

Replica of a browse view on nh3-albok, Linux sshfs 3.7.3 client in an ephemeral
container on nh3-dev, N=5 per condition. Fresh open of a never-opened child
through a cached listing: ENOENT 5/5 with sshfs defaults and 5/5 with hour-long
client caches. Null control (no rename) opens 5/5; held fd and failed-rename
positive controls read 5/5. Replica removed afterwards.

Also closes the post-clear checks in persistent-memory: fv-ml1 GPU 0/1 plateau,
nh3-nas usage, and the mislabelled sfsrv-ana pre-pbs4 item.

stacks/albok-service/README.md

@@ -22,8 +22,13 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
   `/health` gains `browse_withheld`; 0 is normal, and a non-zero value is a WARN. No config change.
   ⚠ **`.browse/` is NOT shared with anyone yet.** The contract gates exposure on a demonstration on the chosen share:
   rename `.browse/` away on the server, then try a fresh open of an unopened child from the client through a cached
-  listing. That open must fail. sshfs `follow_symlinks` works by path; NFS/SMB may keep directory handles. Report a
-  passing surface to albok-dev, who tells the operator. Rollback: `compose.yaml.pre-0.1.14` (0.1.13) is free, because no
+  listing. That open must fail. sshfs `follow_symlinks` works by path; NFS/SMB may keep directory handles.
+  **[2026-10-09] PASSED on sshfs `ro,follow_symlinks` with a Linux client** (SSHFS 3.7.3 / libfuse 3.14): fresh open
+  ENOENT 5/5 with sshfs defaults and 5/5 with hour-long client caches, while the cached listing and stat still showed
+  the child; null and positive controls behaved (`scripts/oneoff/albok-browse-withdrawal/`). Reported to albok-dev.
+  Still before any share: the workstation's own client must re-run that harness if it is macOS (different FUSE
+  backend), and no user is in `albok-read`/`albok-personal` yet, so the operator's user needs those groups (the
+  operator's call; `albok-feedback` stays default-deny). Rollback: `compose.yaml.pre-0.1.14` (0.1.13) is free, because no
   sidecar shape changed.
   Prior: 0.1.13 @ `sha256:bea95617…` (2026-10-07 1135 – 1804) (healthy 1136:17,
   between walks). infra-ops deployed it at albok-dev's ask (althing 8413), from a clean archive of vh/albok `70b55ad7`