doctor.py: six more is_dir()/exists() swallow sites, the class #341 closed one instance of

[fdaviddpt]

An unreadable parent directory made check_directory, check_jit_rules and resolve_project_dir's own --root check swallow to a confident "does not exist"/"no rules for this repo", with a remedy telling the reader to create something that may already be there -- #341's own sentence one call site over, six more times (filed as #363's sweep). Fixes #363.

What changed

• Added _safe_is_dir(path) (swallow-only, mirrors the existing _safe_is_file) for callers that only filter a list, and _dir_state(path) -- a genuine three-state classifier (dir/absent/unreadable) for callers that print a verdict -- near the existing _safe_is_file helper.
• check_directory, check_jit_rules, and resolve_project_dir's own chosen check (the entry point where doctor's third-state contract is established, not merely consumed) now use _dir_state instead of a bare is_dir(), replacing a confident absence with a distinct "could not be checked" WARN.
• resolve_project_dir's .git existence check is now wrapped in its own try/except OSError.
• merge_permission_state's path.exists() now routes an unreadable settings candidate into the unknown bucket the function already had and never reached.
• The two narrow glob-filter comprehensions (jit_hook_roots, _jit_layer_verdict) now use _safe_is_dir so one unreadable candidate no longer wipes every candidate already found via the outer except OSError.

The self-review round that mattered

The first version of _dir_state classified "unreadable" by catching OSError out of Path.is_dir(). A spawned audit (second pass, after the first pass returned a header-less, partially-unstated message and was re-run once per the developer brief) measured directly that on this machine's local Python 3.14, Path.is_dir() itself swallows the PermissionError an unreadable parent produces and returns False -- so the except OSError branch was unreachable on precisely the interpreter CLAUDE.md already names as the one that swallows, and the fix would have silently degraded back into the exact bug #363 exists to close, invisible to CI (which gates 3.9-3.12 only). _dir_state now calls path.stat() instead (measured to raise on the same fixture on 3.14), with FileNotFoundError/NotADirectoryError caught ahead of the general OSError arm so a genuinely absent path isn't folded into "unreadable" -- a regression the first attempt at this fix introduced and this file's own must-not-fire controls caught before commit. The real chmod-based test in the suite, which had been silently self-skipping on this machine with a message blaming "this platform/filesystem", now runs and passes -- it exercises the case it was written for instead of quietly not doing so.

Testing

Every site: an injected, version-independent monkeypatch test, paired with a "must not fire" control confirming genuine absence still reports as absent. Two sites also get a real chmod-based fixture that self-skips loudly with what went untested when the platform's permission model doesn't produce the effect (root, some filesystems, Windows' read-only attribute not blocking a listing) -- and, after the self-review fix, no longer skips on this machine's 3.14. doctor.py's exit 0 always, one VERDICT line contract verified unchanged on every new path.

Full suite: 2587 passed, 2 skipped (unrelated), 0 failed.

Closes #363.