[skygunner]

Problem

The fake_cloudflared test fixture wrote each test's shell script directly to the executable path and executed it. When any process still held a writable handle to that inode (for example a concurrent test fork inheriting the descriptor, or the writing test itself), exec failed with ETXTBSY (ExecutableFileBusy). This is a fixture/stability problem, not a production cloudflared behavior change.

Change

The fixture now executes a checked-in, immutable entrypoint (tests/fixtures/cloudflared.sh) through a symlink and keeps each test's script body in a sibling cloudflared.script data file that the entrypoint sources. Writable handles can only ever target the data file, never the executable inode. $0-relative paths keep working, including the existing <path>.descendant-pid and <path>.script conventions, and quoting keeps them correct in directories containing spaces.

Test-only: no production code, no real Cloudflare access, no credentials, no services are started.

Validation

cargo test --locked -p webcodex --lib fake_cloudflared
  -> 1 passed; 3835 filtered out

With the previous write-to-executable fixture restored, the same regression fails:
  called `Result::unwrap()` on an `Err` value: Os { code: 26, kind: ExecutableFileBusy, message: "Text file busy" }
  test result: FAILED. 0 passed; 1 failed; 3835 filtered out

cargo test --locked -p webcodex --lib cloudflare
  -> 33 passed; 5 ignored; 0 failed (includes the tunnel lifecycle/descendant cleanup tests that use this fixture)

The regression keeps writable handles open on every regular file in the fixture directory while invoking the fake binary, then asserts the expected stdout and exit status.

Platform: #[cfg(unix)], matching the existing fixture. Not run here: Windows and macOS lanes (no environment available).

[yyjeqhc]

Reviewed the scoped implementation and regression coverage against its source baseline; CI and diff checks pass. No blocking issue identified.