Transport-integrity errors discard filesystem causes needed for debugging #68790

Summary

Review of #68732 at commit 40c71f95ad05d3f2da56bc19e38e3f041495f7e9 found a P3 diagnostics gap: capture and verification catches discard the original filesystem error, reporting every failure as Safe-output transport changed after capture.

Location

actions/setup/js/transport_integrity.cjs:45–48,64–65

Reproduction and evidence

Call captureOptional with a missing artifact path. The resulting TransportIntegrityError reports a transport change but has no retained ENOENT cause.

The same catch paths also discard errors from descriptor open/read/stat operations. Operators cannot reliably distinguish missing files, permissions/I/O problems, and genuine content or identity changes from the returned diagnostic.

Expected behavior

Preserve underlying causes and provide safe, actionable diagnostic metadata identifying the failed operation and filesystem error code, while keeping fail-closed behavior.

Suggested fix and coverage

Pass caught errors through the existing fail(filePath, cause) mechanism and expose an appropriate reason/operation through repository-standard logging or structured handler diagnostics. Never log artifact contents or secret values.

Add tests for missing-file, permission/read failure, identity replacement, and content mismatch diagnostics. Existing cause coverage only exercises snapshot-write failure.

No fix was applied.