fix(tee): tolerate hostfs mount boundaries

internal/tee/bootstrap.go

@@ -237,6 +237,12 @@ func syncDirectoryAncestors(path string) error {
 	current := filepath.Clean(path)
 	for {
 		if err := syncDirectoryFn(current); err != nil {
+			// EGo hostfs mounts can expose the target directory without its
+			// virtual parent directories. Once the target was synced, ENOENT
+			// marks that mount boundary rather than a failed durable write.
+			if current != path && errors.Is(err, fs.ErrNotExist) {
+				return nil
+			}
 			return err
 		}
 		parent := filepath.Dir(current)

internal/tee/bootstrap_test.go

@@ -282,6 +282,30 @@ func TestEnsureDirectorySyncsExistingDirectoryAncestors(t *testing.T) {
 	}
 }
 
+func TestSyncDirectoryAncestorsStopsAtMissingMountParent(t *testing.T) {
+	previous := syncDirectoryFn
+	t.Cleanup(func() { syncDirectoryFn = previous })
+
+	mountDir := filepath.Join(t.TempDir(), "mounted")
+	mountParent := filepath.Dir(mountDir)
+	var synced []string
+	syncDirectoryFn = func(path string) error {
+		path = filepath.Clean(path)
+		synced = append(synced, path)
+		if path == mountParent {
+			return fs.ErrNotExist
+		}
+		return nil
+	}
+
+	if err := syncDirectoryAncestors(mountDir); err != nil {
+		t.Fatalf("sync mount directory ancestors: %v", err)
+	}
+	if want := []string{filepath.Clean(mountDir), filepath.Clean(mountParent)}; !slices.Equal(synced, want) {
+		t.Fatalf("synced=%v want=%v", synced, want)
+	}
+}
+
 func TestEnsureDirectoryRetriesSyncAfterCreationFailure(t *testing.T) {
 	previous := syncDirectoryFn
 	t.Cleanup(func() { syncDirectoryFn = previous })