Merge nucleic/mellow-dewy-falcon-rjhr into main

Resources/provision.sh

@@ -124,8 +124,16 @@ fi
 # --------------------------------------------------------------------------
 log "ensuring /usr/local/bin exists and is on PATH for non-login shells"
 mkdir -p /usr/local/bin
-chown root:wheel /usr/local /usr/local/bin
-chmod 755 /usr/local /usr/local/bin
+# Best-effort, deliberately: on a stock macOS 27 install /usr/local already
+# exists, already is root:wheel 755, and is SIP-protected — so chown and chmod
+# on it fail with "Operation not permitted" even as root. The directory is
+# already exactly as we want it, so treating that refusal as a build failure
+# would abort provisioning over a no-op. When /usr/local really was ours to
+# create, these succeed.
+chown root:wheel /usr/local /usr/local/bin 2>/dev/null \
+    || warn "could not chown /usr/local (system-owned and SIP-protected; already correct)"
+chmod 755 /usr/local /usr/local/bin 2>/dev/null \
+    || warn "could not chmod /usr/local (system-owned and SIP-protected; already correct)"
 
 ZSHENV_MARKER="# gitea-macos-runner: ensure /usr/local/bin on PATH"
 if [ ! -f /etc/zshenv ] || ! grep -qF "$ZSHENV_MARKER" /etc/zshenv 2>/dev/null; then