Drain permission cache rewrites before test cleanup

[ken-jo]

Motivation

Permission tests created scratch directories without deterministic teardown. A separate cache lifecycle race made cleanup unsafe: synchronous stale or expired lookups schedule a background cache rewrite, so removing the directory immediately could race an in-flight writer.

Scope

• add an awaitable VerdictCache.flush() completion boundary for lookup-triggered background rewrites while preserving best-effort cache semantics
• register every scratch directory immediately at all 33 affected creation sites across 13 permission test files
• centralize temp-directory and flushable resource ownership in one permission test fixture
• settle every tracked writer before attempting every directory cleanup, then report failures together without losing retryable work
• cover consecutive prune rewrites, delayed directory recreation, mixed flush and cleanup failures, and directory-only retry behavior

Impact and risk

Runtime permission decisions, cache keys, TTL, invalidation, and fail-closed behavior are unchanged. The production change only exposes completion for already-scheduled cache rewrites. Test teardown now removes its owned scratch state deterministically and remains retryable when teardown itself fails.

Risk is low and localized to the reviewer cache writer lifecycle and test-only teardown. No UI, IPC, schema, persisted authoritative data, dependency, or companion-repository changes are included.

Validation

• duplicate helper gate: 1,155 test files scanned, 0 duplicate helper implementations
• focused permission suite: 13 files, 260 tests passed
• fixture failure-path suite: 2 tests passed
• bun run typecheck
• bun run check:typecheck-tests
• bun run check:source-text-safe
• git diff --check
• independent re-review: no remaining blockers
• pre-push full gate passed: typecheck, 1,012 test files and 12,874 tests, production build, and all static policy checks

UI or E2E evidence: not applicable; no user interface behavior changed.

Companion repository PRs: none.