scripts/tests EXIT traps outside the derived set: path-persist reports PASS with exit 1, telemetry-token-migration stalls unbounded

[shujaatTracebloc]

Two EXIT-trap defects in scripts/tests/ that the new cleanup-trap guard cannot see, because neither script calls create_cluster. Found by @LukasWodka while reviewing #985, and split out deliberately rather than widening that PR past its derived set.

1. scripts/tests/path-persist.sh:180 — a passing run reports failure

The trap's last statement is an AND-list. set -e exempts commands in a &&/|| list except the last one, so when the left side is false the list's status becomes the trap's status and replaces the harness verdict. Driven at head:

branch	result
IS_TEMP_INSTALLER=1 (CI's URL branch)	RESULT: PASS, exit 0
IS_TEMP_INSTALLER=0 (local-file branch)	RESULT: PASS, exit 1

So the script prints PASS and exits non-zero whenever TRACEBLOC_CLI_REF points at a local file. CI always takes the URL branch, which is why this has never been seen — it bites a developer running against a local CLI checkout, i.e. exactly the person least likely to suspect the harness rather than their change.

This is a verdict inversion, not a stall: the run worked and reported failure.

2. scripts/tests/telemetry-token-migration.sh:92 — unbounded and silenced in an EXIT trap

kc delete ns … >/dev/null 2>&1 || true inside the EXIT trap. The || true keeps the verdict safe, so this one cannot invert a result — but the call is unbounded and against a cluster that a failing run has good odds of having left unhealthy, and the redirection makes the stall invisible. That is the #979 shape: the job burns its timeout-minutes budget and reports cancelled with nothing in the log saying why.

Why these are worth a ticket rather than a note

Both are in scripts/tests/, both are EXIT-trap hygiene, and both are outside the set #985's guard derives — it enumerates harnesses that call create_cluster, and neither of these does. So the guard is correct within its scope and simply cannot reach them. Widening that guard's derivation to every trap … EXIT in scripts/tests/ would cover both and is probably the right fix, but it changes what that guard claims, so it belongs here rather than bolted onto a PR already in review.

Suggested shape

• path-persist.sh:180 — make the reap the left side of a || with an unconditional return 0, the pattern e2e_reap_path already establishes in scripts/tests/e2e-common.sh (landed in fix(tests): bound the k3d cleanup in all seven e2e EXIT traps (client#979) #985). Same fix, same helper if it is reachable from here.
• telemetry-token-migration.sh:92 — bound it with _bounded and stop silencing the failure; log what happened.
• Widen the cleanup-trap guard's derivation from "harnesses that call create_cluster" to "every trap … EXIT in scripts/tests/", with a non-vacuity assertion on the derived count so an empty or short glob reddens rather than passing.

Guard that must fail first

For site 1 the reproduction is the table above: drive path-persist.sh with IS_TEMP_INSTALLER=0 and assert the exit status matches the printed verdict. That case currently fails and is the whole ticket — a guard asserting only that the trap runs would pass today.

Relative, not duplicate: #986 is the same class (an unbounded step whose stall reads as a 20-minute cancelled) at a different site — the Prereqs matrix step in installer-tests.yaml. Part of tracebloc/backend#2849.