fix(utils): clean read-only temporary package directories

[iloveeyjafjalla]

Fixes #2169

When a real OSTree temporary merged checkout contains a read-only package directory, remove_all can fail and TemporaryDirectory silently discards its cleanup path. Retry after using the existing directory-only permission helper; log any cleanup error that remains.

The regression imports binary/develop modules into a real temporary OSTree repository, preserving a read-only directory before checkout. It confirms the temporary tree is removed after TempLayerDir destruction and the installed package file keeps its permissions. Original production code fails with the temporary path still present. Root skips this permission test explicitly; validation ran as the ordinary Linux user.

Validation on Ubuntu 22.04 WSL2 x86_64 / GCC 11.4 / Qt 5.15.3 / CMake 3.31.6:

• Original production regression: failed; fixed regression: passed.
• Final independent CMake debug build: passed; complete CTest: 745/745 passed, no skipped tests, using the current target baseline.
• Repository pre-commit, including clang-format 22.1.8, and whitespace check: passed.
• Independent read-only review: no blocking correctness finding.

The complete test environment uses upstream erofs-utils 1.8 in a private Linux mount namespace, then runs CTest as an ordinary user; the system's 1.4 installation stays unchanged. Release, Qt6/ARM CI, complete UABX export, container launch and live remote service requests were not tested. Explicit external symlink/hardlink fixtures and arbitrary root-permission failures were not tested; the reused helper's directory-only behavior was reviewed from source. Hosted checks will be reported separately after publication.

AI assistance: prepared and independently reviewed with OpenAI Codex. The executed results and failure/pass logs are retained.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[deepin-ci-robot]

Hi @iloveeyjafjalla. Thanks for your PR.

I'm waiting for a OpenAtom-Linyaps member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.