Push validation cannot mount its isolated checkout on NFS

Symptom: native tests, documentation, and lint pass, then Docker reports permission denied for .ci-validation/push.*/repo before container tests start.

Root cause: mktemp -d creates a private directory. On an NFS export with root squashing, the Docker daemon cannot traverse that directory even though the invoking user can read the checkout. A restrictive caller umask can also make cloned files unreadable to the container.

Confirm: inspect the permissions of .ci-validation/ and the push.* ancestor while validation runs. A bind mount of the same test source succeeds once the gate-owned ancestors allow traversal and the source is readable.

Fix: use the updated tests/pre-push.sh and retry git push. The gate creates a readable snapshot with traversable ancestors and no write access for other users; it leaves the original checkout permissions unchanged. The checkout’s existing parent directories must also be accessible to Docker. See validation before publishing.