testsuite: fix the two macOS cells the 3.5.0 fleet run flagged

Running the 3.5.0 suite against this branch across the fleet left four
not-OK cells, all macOS, identical on both backport branches.  Both causes
are here, not in the code under test.

t_symlink_secure.c lives at the tree ROOT, so fleettest's overlay -- which
replaces runtests.py and testsuite/ -- does not update it.  This branch was
still running a version predating the HAVE_MKNODAT guard, so on a platform
without mknodat() (macOS 10.13) it asserted a confinement the build
deliberately compiles out and reported "basename symlink was followed ->
module escape".  Alarming and wrong: there is no escape, the helper was just
older than the test driving it.  Taking the current helper makes it skip
there, which is what the fleet config already expects for that target.

partial-protected-regular-retry-policy exercises the receiver's EACCES
recovery path.  That path is 3.5.0-only -- the chmod-on-denied-open work is
not backported, which is also why partial_nowrite is already excluded here --
so the test cannot reach what it checks and reports "inconclusive" rather
than skipping.  Excluded for the same reason as its sibling.

Verified on the x86-64 macOS box: the policy test is excluded and
symlink-mknod-fakesuper-symlink-race now skips, overall result 0.  A 3.5.0
build on the same hardware passes both, so neither is a platform limitation.

t_symlink_secure.c

@@ -88,6 +88,16 @@ int main(int argc, char **argv)
 	int poc = 0;
 	const char *moddir;
 
+# if !defined(HAVE_MKNODAT) && !defined(TEST_SYMLINK_PLACEHOLDER)
+	/* Nothing left to assert: the do_mknod_at() checks need mknodat(), and
+	 * the do_symlink_at() ones are not compiled here.  Skip rather than
+	 * pass vacuously. */
+	(void)argc; (void)argv;
+	fprintf(stderr, "SKIP: no mknodat() and no symlink placeholders -- "
+		"nothing this helper asserts applies to this build\n");
+	return 77;
+# endif
+
 	if (argc == 3 && strcmp(argv[1], "--poc") == 0) {
 		poc = 1;
 		moddir = argv[2];
@@ -131,11 +141,17 @@ int main(int argc, char **argv)
 	check_preserved("do_symlink_at slashed", "../outside/secret_sym2", "VICTIM_SYM2");
 #endif
 
+# ifdef HAVE_MKNODAT
+	/* Without mknodat() do_mknod_at() IS do_mknod(): the confinement is
+	 * compiled out by design (SECURITY.md), so these would assert a
+	 * property the build deliberately does not have.  The do_symlink_at()
+	 * checks above do not depend on it and still run. */
 	do_mknod_at("nodpath", S_IFCHR | 0600, 0);
 	check_preserved("do_mknod_at bare", "../outside/secret_nod", "VICTIM_NOD");
 
 	do_mknod_at("sub/nodpath2", S_IFCHR | 0600, 0);
 	check_preserved("do_mknod_at slashed", "../outside/secret_nod2", "VICTIM_NOD2");
+# endif
 
 	if (errs)
 		fprintf(stderr, "%d failure(s)\n", errs);

testsuite/skiplist/backport.txt

@@ -24,6 +24,7 @@ preallocate                             # --preallocate --sparse hole punching (
 daemon-refuse-compress-threads-alias    # --compress-threads arrived in 3.4.2
 daemon-zstd-thread-exhaustion           # --compress-threads arrived in 3.4.2
 partial_nowrite                         # receiver chmod-on-denied-open (3.5.0)
+partial-protected-regular-retry-policy  # EACCES recovery path (3.5.0, macOS-only test)
 
 # The suite's per-platform skip lists describe the tests IT ships, so they do
 # not describe a build of this branch.