Verify deployment-managed cache permissions

docs/roadmap/implementation.md

@@ -303,6 +303,8 @@ prompt.
 
 ## Stage 5: Repository-Wide Verification And Contract Audit
 
+**Completed:** 2026-09-11
+
 ### Goal
 
 Prove the complete target state and catch accidental permission, safety, or

internal/cli/state_permissions_unix_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -43,19 +44,10 @@ func assertGroupAccessibleCacheTree(t *testing.T, root string) {
 			want = 0o770
 		}
 		if got := info.Mode().Perm(); got != want {
-			return &cachePermissionError{path: path, got: got, want: want}
+			return fmt.Errorf("%s mode = %#o, want %#o", path, got, want)
 		}
 		return nil
 	}); err != nil {
 		t.Fatal(err)
 	}
 }
-
-type cachePermissionError struct {
-	path      string
-	got, want os.FileMode
-}
-
-func (err *cachePermissionError) Error() string {
-	return err.path + " mode mismatch"
-}