fix(qa): track qa-reresolve-hw-test.sh executable (litclock-dev#682)

CHANGELOG.md

@@ -29,6 +29,7 @@ All notable changes to LitClock are documented here. Format loosely follows [Kee
 - **The "do NOT clone this card" warning can now actually print** (litclock-dev#649). `prepare-for-cloning.sh` removes the per-device setup-WiFi password before an SD card is duplicated — the most safety-critical step in the file, because since litclock-dev#620 that password is permanent, so a card cloned with it intact would hand every recipient a network key the preparer knows. The step was guarded by a check that reports failure in red and tells the operator, in one sentence, exactly what not to do next. Under the script's `set -e`, a genuinely failing `rm` terminated the script **on the `rm` line**, so the check below it never ran and none of those three red lines ever printed. The warning written specifically to stop a key-reuse mistake was unreachable in exactly the situation it was written for. Hardware-verified by planting an undeletable file: the script exits 1 and never prints the success banner — so the literal requirement, "aborts rather than reporting success", was met — but the output ends mid-line at `Clearing setup-hotspot password... ` with nothing after it. An operator sees a truncated line and a stopped script, and is told nothing about the card in their hand. `chattr +i` is a contrived way to reproduce it; the realistic cause is a degrading SD card remounting read-only, or ownership drift on `/var/lib/litclock`, either of which lands at the exact moment someone is preparing cards to give away. The `rm` now takes the `|| true` that fifteen other calls in the same file already use for the same reason — the existence check that follows is the real gate, and the comment at line 68 had already spelled out the hazard verbatim. Testing needed the same correction: a test asserting the exit code passes with the bug present, since the exit code was never wrong. The new tests lift the real step out of the shipped script (verifying the span they lifted) and execute it against a temp directory with a forced removal failure, so the warning is asserted where it has to appear — on stdout, in the failure case. Review also caught that the check the step calls "the real gate" could miss a survivor: `-e` follows symlinks and is false for a dangling one, so a failed unlink of a dangling symlink at the password path reported success. The invariant is that no entry survives there — a surviving entry means the removal did not do what it claimed, whatever it points at — so the check now tests `-L` too. And since the point of the step is that the operator learns something actionable, `rm`'s own diagnosis is now surfaced instead of discarded — "Read-only file system" means the card is dying, "Operation not permitted" means ownership drift, and those need opposite remedies. **This does not make clone prep sufficient on its own**: the key also lives in a NetworkManager connection profile the optional WiFi wipe does not clear by default, and in persistent journald via sudo's command-audit line, both tracked separately (litclock-dev#653, litclock-dev#654).
 
 ### For contributors
+- **`scripts/qa-reresolve-hw-test.sh` is tracked executable again, so an update stops dirtying the tree** (litclock-dev#682). `update.sh` Phase 6 runs `chmod +x` over `scripts/*.sh`, and this one file was tracked `100644`, so every update on every clock chmod'd it, left the tree dirty, and the **next** update then warned "uncommitted changes detected — will be overwritten by update", promised to overwrite them, and did not. Nothing broke; the cost is that the one line which should make an operator stop and look fired unconditionally on every device and was wrong every time, which is how a real warning gets trained out of usefulness. Observed on the fleet sentinel against v0.224.0. The mode was correct in the development repo all along and was lost in the port, so this is a repair of that port rather than a behaviour change — no file content is touched. A sweep of the other `chmod` targets found no second instance.
 - **Contributions now state which license they arrive under, and corpus contributors get the translation caveat before they start.** The MIT/CC BY-NC-SA split left `CONTRIBUTING.md` — over 450 lines that walk a contributor through corpus editing in detail — without the word "license" anywhere, so "inbound = outbound" had more than one possible answer once the repo carried more than one outbound license. It now names three buckets: code, scripts, tests, configuration and documentation prose under MIT; the corpus, the `gold_set_192.csv` sample and the images generated from the corpus under CC BY-NC-SA 4.0; and bundled third-party assets (case STLs CC BY, weather icons CC BY-SA 4.0, fonts OFL-1.1) under the license they arrived with, so a contributor changing an STL is not silently assumed to be granting MIT. Opening a PR confirms the right to contribute and licenses the material to the project *and to everyone who receives the project* — CC BY-NC-SA 4.0 §2(a)(5) makes downstream recipients licensees of the contributor, not sublicensees of this project — while copyright itself stays with the contributor. The PR template carries the same terms as an acknowledgement, which is where a contributor actually looks. The caveat aimed at the waiting localization volunteers ([#19](https://github.com/kapoorankush/litclock/issues/19)): **a quote's copyright status is not the book's** — a translation is protected separately and usually owned by the translator *or their publisher*, so a public-domain novel does not put a modern translation of it into the public domain, and permission from a translator may not be theirs to give. A row from an old novel is a short excerpt of a long out-of-copyright work; a row from a modern translation is the whole of that translator's work on that passage. Also corrected: `NOTICE.md`'s quote-source table now lists the Guardian reader thread that README already credited, names the renamed upstream account (JohannesNE → JohsEnevoldsen, whose old raw URL 404s because GitHub does not redirect those — `gather_quotes.py` was silently skipping the source), and records arthurgassner/timeteller accurately as a **byte-identical mirror** of that upstream rather than an independent quote source.
 
 ## [v0.222.0] - 2026-07-23