DSM 7.2.2's synoshare CLI has no --setopt subcommand. The call I added
in PR #23 for QA F2 was based on an incorrect assumption and wasn't
verified against a fresh golden image build. It only surfaced in CI
because my local run used a pre-existing golden image.

The production code in list_recycle_bin already handles the disabled
case gracefully (returns "Recycle bin is not enabled" instead of
raising), and test_02_list_recycle_bin's permissive assertion accepts
either response. Removing the enablement step actually exercises the
more valuable 408 fallback path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary

Closes the last phase of #18 by adding a GitHub Actions workflow that
runs the 47 vdsm integration tests on every PR.

**Job design:**
- Dedicated workflow file (`.github/workflows/vdsm.yml`), independent
from `ci.yml` so a vdsm flake never blocks unit-test merges
- `runs-on: ubuntu-24.04` — Azure-backed GH-hosted runners expose
`/dev/kvm` for nested KVM
- Golden image cached via `actions/cache@v4`, keyed on DSM version +
hash of setup scripts
- Cache miss path runs `scripts/vdsm_setup.py --yes` to build from
scratch (~10 min)
- `continue-on-error: true` initially — not a blocking required check
until stable across several runs
- `timeout-minutes: 30`
- Test logs uploaded as artifacts on failure

**Prep change:** `scripts/vdsm_setup.py` gets a `--yes/-y` flag so the
overwrite prompt doesn't stop the non-interactive CI run.

**In-scope revert of PR #23 recycle bin enablement:** The first CI run
(the fresh golden image build) surfaced that PR #23's `synoshare
--setopt testshare enable_recycle_bin=yes` call fails with rc=255 on DSM
7.2.2 — `--setopt` is not a valid `synoshare` subcommand. The call only
worked locally because the pre-existing golden image pre-dated the
change. Commit `ae65df4` removes the enablement step; the integration
test still passes because `list_recycle_bin`'s production 408 handler
(also added in PR #23) returns the "Recycle bin is not enabled" message
gracefully, and `test_02_list_recycle_bin`'s assertion
(`isinstance(result, str)`) accepts both states. Documented in `###
Fixed` of the CHANGELOG and in the `TestRecycleBin` class docstring.

## Test plan

### Automated
- [x] `lint`, `typecheck`, `test (3.11|3.12|3.13)`, `version-sync` still
pass
- [x] New `vdsm` job runs to completion
- [x] On first run (no cache): golden image built from scratch, saved to
cache, 47/47 tests pass
- [x] On second run (cache hit): golden image restored, 47/47 tests
pass, job finishes noticeably faster than first run

### Manual
- [ ] Verify the vdsm job is NOT in the required checks list (because
`continue-on-error: true`)
- [ ] Inspect cache size in the Actions UI (should be ~900MB — well
under the 10GB limit)
- [ ] Confirm workflow artifacts upload on intentional failure (can
validate post-merge)

### Follow-up (not in this PR)
- After 5+ consecutive green runs on `main`, promote the job to a
required check by removing `continue-on-error` and adding to branch
protection

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: cmeans-claude-dev[bot] <3223881+cmeans-claude-dev[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

QA round-3 finding: `prefix: "chore(deps)"` combined with
`include: "scope"` produces double-scope commit subjects like
`chore(deps)(deps): bump foo` because Dependabot auto-appends
`(deps)` (or `(deps-dev)`) to the prefix when scope-include is on.
Confirmed in cmeans/pypi-winnow-downloads, where the same config
is producing doubled prefixes on every live Dependabot PR (e.g.
PR #23 "chore(deps)(deps): bump codecov/codecov-action ...").

Canonical Dependabot pattern: `prefix: "chore"` + `include: "scope"`
yields `chore(deps): bump foo`. This also leaves room to add
`prefix-development: "chore"` later if we want to distinguish
prod vs dev dep bumps in commit subjects without touching the
core prefix.

Same fix should be cascaded to cmeans/pypi-winnow-downloads as a
follow-up — the bug originates from that pattern repo.

## Summary

Closes #37. Replaces the always-empty `recycle_status: dict[str, bool] =
{}` at `modules/filestation/__init__.py:238` with a lazy per-share probe
that populates the cache on first observation. Pre-fix, `delete_files`
always reported `"Recycle bin is enabled on /{share}"` regardless of
actual DSM state — confusing UX for users with `#recycle` disabled on a
share, since their data was actually permanently gone.

## Design

**Lazy probe** — `ensure_recycle_status(client, share, recycle_status)`
in `modules/filestation/helpers.py`:
- Cache hit → return cached bool
- Cache miss → `SYNO.FileStation.List` on `/{share}/#recycle` with
`limit=0` (cheap, just probes existence)
- Success → `True`, DSM 408 (path not found) → `False`
- DSM 105 (permission denied) or any other error → `True` + WARNING log
(preserves prior optimistic-default behavior; surfaces unknown states in
logs for operator visibility)
- Result cached in-place for the session lifetime

**Self-correct on observation** —
`correct_recycle_status_from_observation` updates the cache when
`list_recycle_bin` sees DSM behavior contradicting the cached value
(cached `True` but the actual list returns 408 → flip to `False`; or
cache says `False` then the live call succeeds → flip to `True`). Logs
at INFO. Means subsequent `delete_files` calls in the same session see
corrected state without waiting for re-auth.

**Invalidate on re-auth** — Two-layer hook:
- `AuthManager.add_on_reauth_callback(cb)` registers callbacks, fired
after `_re_authenticate` succeeds. Exceptions in callbacks are logged
(`WARNING`) and don't block other callbacks.
- `SharedClientManager.subscribe_on_reauth(cb)` proxies subscriptions
made before the AuthManager is lazily created (sync `register()` time)
and flushes them on first `get_client`.
- Filestation `register()` subscribes `recycle_status.clear` so
admin-side `#recycle` toggles between sessions are picked up after the
next session-error-driven re-auth.

**`list_shares` left alone** — renders whatever's cached at the moment;
not a correctness path. Kept cheap.

## Out of scope (intentional)

- **Persistence**: `ServerState.recycle_bin_status` exists on the model
but `load_state`/`save_state` aren't currently wired up at all in
`SharedClientManager`. Wiring persistence touches a much larger surface
than #37 alone needs. Per signoff, treating as a separate follow-up.
- **vdsm integration test**: `synoshare --setopt` recycle-toggle
reliability on DSM 7.2.x is unproven (PR #23 reverted a similar setopt
for share creation). Per signoff, unit tests carry the regression load
until vdsm behavior is verified — vdsm follow-up will land separately.

## Acceptance criteria

- [x] Module init / first-call lazy init probes each configured share
for `#recycle` existence and caches the result. *(Probes lazily on first
observation per share, not at init.)*
- [x] Result is passed into `delete_files()` so the correct with-recycle
vs NOT-enabled message fires per-share. *(Plus the same on
`list_recycle_bin`.)*
- [x] Cache invalidation strategy documented. *(Clear-on-reauth +
self-correct-on-observation.)*
- [x] Unit test: a share with `#recycle: False` produces the
permanent-delete message; with `True` produces the recoverable message.
*(Existing tests + new lazy-probe test in `TestDeleteFiles`.)*
- [ ] Integration test against vdsm verifying real DSM recycle-bin state
matches. *(Out of scope per signoff; follow-up.)*
- [x] CHANGELOG `### Fixed` entry.

## QA

### Manual tests

1. - [x] Run `uv run pytest` — 546 pass, 96.10% coverage (gate: 95%).
2. - [x] Run `uv run ruff check src/ tests/ scripts/` — clean.
3. - [x] Run `uv run ruff format --check src/ tests/ scripts/` — clean.
4. - [x] Run `uv run mypy src/ scripts/` — strict-mode clean.
5. - [x] Spot-check `git grep -n
'recycle_status\b\|recycle_bin_status\b' src/` shows the closure dict
reaches `delete_files`, `list_recycle_bin`, and `list_shares` (the last
unchanged), with no remaining `# Assume recycle bin by default`
fall-through branch on the populated path.
6. - [x] Spot-check `git grep -n
'subscribe_on_reauth\|on_reauth_callbacks' src/` shows the AuthManager
API + SharedClientManager proxy + filestation `register()` subscription
are all wired together.
7. - [x] Run `uv run pytest
tests/modules/filestation/test_helpers.py::TestEnsureRecycleStatus
tests/modules/filestation/test_helpers.py::TestCorrectRecycleStatusFromObservation
-v` — 9 pass; covers cache hit, probe-success, probe-408,
probe-105+WARN, probe-other+WARN, memoization, and the three
self-correct cases.

### New test classes

| Test class | File | Cases |
|---|---|---|
| `TestEnsureRecycleStatus` |
`tests/modules/filestation/test_helpers.py` | 6 (cache hit,
success-True, 408-False, 105+WARN, other-error+WARN, memoization) |
| `TestCorrectRecycleStatusFromObservation` |
`tests/modules/filestation/test_helpers.py` | 3 (disagreement flips,
agreement no-op, missing-key sets default) |
| `TestOnReauthCallbacks` | `tests/core/test_auth.py` | 3 (callback
fires after re-auth, exception in one doesn't block others, registration
API works pre-reauth) |
| `TestSharedClientManagerSubscribeOnReauth` |
`tests/core/test_server.py` | 3 (pre-auth queues, pending flushes on
get_client, post-auth attaches directly) |
| Added to `TestDeleteFiles` |
`tests/modules/filestation/test_operations.py` | 1 (lazy probe on
missing share, with respx-driven 408) |
| Added to `TestListRecycleBin` |
`tests/modules/filestation/test_listing.py` | 2 (self-correct on
disagreement, self-correct no-op on agreement) |

### Verification I already ran

| Check | Result |
|---|---|
| `uv run pytest` | **546 passed**, 94 deselected, 96.10% coverage |
| `uv run ruff check src/ tests/ scripts/` | clean |
| `uv run ruff format --check src/ tests/ scripts/` | clean |
| `uv run mypy src/ scripts/` | clean (30 files, strict-mode) |

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: cmeans-claude-dev[bot] <272174644+cmeans-claude-dev[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>