obsidian_headless: grant the service user on shared folders too (WDWL-22)

Content multica creates in inbox/ is owned multica:multica, so obsync fell
into "other" (---) and Sync could neither read nor upload Wong's
submissions. Found after the real Sync sign-in on spaceship-earth; the
earlier verify only tested the obsync -> multica direction.

Shared folders now carry user:obsync:rwx as an access and a default entry
alongside the shared user's, and verify tests the multica -> obsync
direction (read + rewrite, as merge needs). Second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/tasks/verify.yml

@@ -18,6 +18,61 @@
   changed_when: false
   check_mode: false
 
+# The reverse direction: what the shared user writes, Sync must be able to
+# read (to upload it) and rewrite (to merge remote edits into it).
+- name: Verify | Content a shared user creates stays usable by the service (create)
+  ansible.builtin.command:
+    argv:
+      - /bin/sh
+      - -c
+      - 'd="$1/.obh-verify-rev"; mkdir -p "$d" && echo ok > "$d/note.md"'
+      - sh
+      - "{{ obsidian_headless_vault_path }}/{{ item.path }}"
+  become: true
+  become_user: "{{ item.user }}"
+  loop: "{{ obsidian_headless_shared_folders }}"
+  loop_control:
+    label: "{{ item.user }} -> {{ item.path }}"
+  changed_when: false
+  check_mode: false
+
+- name: Verify | Content a shared user creates stays usable by the service (use)
+  ansible.builtin.command:
+    argv:
+      - /bin/sh
+      - -c
+      - 'd="$1/.obh-verify-rev"; grep -q ok "$d/note.md" && echo more >> "$d/note.md" && echo ok > "$d/reply.md"'
+      - sh
+      - "{{ obsidian_headless_vault_path }}/{{ item.path }}"
+  become: true
+  become_user: "{{ obsidian_headless_user }}"
+  loop: "{{ obsidian_headless_shared_folders }}"
+  loop_control:
+    label: "{{ item.path }}"
+  register: _obh_reverse
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Verify | Remove the reverse probes
+  ansible.builtin.file:
+    path: "{{ obsidian_headless_vault_path }}/{{ item.path }}/.obh-verify-rev"
+    state: absent
+  loop: "{{ obsidian_headless_shared_folders }}"
+  loop_control:
+    label: "{{ item.path }}"
+  changed_when: false
+
+- name: Verify | The service can read and rewrite shared users' content
+  ansible.builtin.assert:
+    that:
+      - _obh_reverse.results | rejectattr('rc', 'equalto', 0) | list | length == 0
+    fail_msg: >-
+      {{ obsidian_headless_user }} cannot read or write content a shared user
+      created; Sync would never upload it. Check the user:{{ obsidian_headless_user }}
+      default ACL entry on the shared folder.
+    quiet: true
+
 # Simulates the service: obsync, umask 0077, creating a folder and a file the
 # way Sync does. The shared user must still reach both, via the default ACL.
 - name: Verify | Content the service creates in a shared folder inherits the grant (create)