usb-kernel-recover: scripted shield/unshield with recorded restore and ownership

The shield in usb-kernel-recover (.claude/skills/usb-kernel-recover/SKILL.md, section 2: chmod 000 on the nine locking sysfs attributes of the wedged leaf, its parent hub and the root hub, so libusb enumerators skip the wedged device) exists only as a prose recipe. scripts/usb_recover.sh has root-cycle, pci-rebind, pci-bind and authorized, but no shield or unshield, and the recipe's restore step is a manual stat/chmod from a healthy sibling.

Without a scripted primitive, in-run recovery cannot reach J-Link probes past a poisoned node (#3945), and every human recovery re-derives the attribute list and the restore by hand.

Remaining work

• usb_recover.sh shield <busport> and unshield <busport>, kept beside the other privileged host operations (hil_pool_check.py already calls this script).
• Shield records each object's original modes and identity/generation (sysfs inode) before changing anything, for leaf, parent hub and root hub. Unshield restores the recorded modes on the surviving original objects only, never from a healthy sibling: siblings can differ or carry another active shield.
• Ownership record per shield so an interrupted owner (SIGKILL, dead runner) can be detected and its stale shield restored by identity check. Never a blind unshield of everything at startup.
• Overlapping shields on a shared root hub: refuse or reference-count, never let one owner's unshield drop another's.
• SKILL.md section 2 shrinks to when and why, pointing at the commands.
• Tests in .claude/test/ against a fake sysfs tree: happy path, overlap, partial acquisition, vanished or replaced device, interrupted owner, restore.

Verification

Unit tests above. Rig: shield a live board on ci.lan, confirm JLinkExe enumerates the rest of the rig with the wedged node present, unshield, compare modes to the pre-shield record.

Why deferred

Agreed in the 2026-09-21 HIL review with Codex as step three of five, after #3944 and #3945. The primitive must exist and be tested before post-pool recovery (next step) can use it.