Treat the guard test's socket fixture as optional (#6755)

Standing in for an abandoned compositor means binding a Unix socket, and the
sandboxes this guard exists for are the ones that deny it: the fixture raised
PermissionError and took the whole file down with set -e, adding a failure in
the environment the guard was written to keep clean. Run the cases that need no
socket first and skip the rest when one cannot be bound.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/shell.d/compositor-guard-test.sh

@@ -4,8 +4,6 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 
-require_command python3
-
 test_dir=$(mktemp -d)
 trap 'rm -rf "$test_dir"' EXIT
 
@@ -14,8 +12,16 @@ stub_bin="$test_dir/bin"
 mkdir -p "$runtime_dir" "$stub_bin"
 
 # A bound AF_UNIX socket outlives the process that bound it, which is exactly the
-# corpse a dead compositor leaves behind.
-python3 -c 'import socket, sys; socket.socket(socket.AF_UNIX).bind(sys.argv[1])' "$runtime_dir/wayland-1"
+# corpse a dead compositor leaves behind. Binding one is the only way to get a
+# file that passes -S, and the sandboxes this guard exists for are the ones that
+# deny it, so treat the fixture as optional rather than fail there.
+socket_bound=1
+if command -v python3 >/dev/null; then
+  python3 -c 'import socket, sys; socket.socket(socket.AF_UNIX).bind(sys.argv[1])' \
+    "$runtime_dir/wayland-1" 2>/dev/null || socket_bound=0
+else
+  socket_bound=0
+fi
 
 attempts_log="$test_dir/hyprctl-attempts"
 
@@ -68,6 +74,12 @@ output=$(run_guard WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR="$test_dir/blocked"
 [[ $output == "$skipped" ]] || fail "guard skips when the socket is unreachable" "$output"
 pass "guard skips when the socket is unreachable"
 
+# Everything below needs a socket to stand in for a live or abandoned compositor.
+if (( ! socket_bound )); then
+  pass "cannot bind a Unix socket here; skipping the cases that need one"
+  exit 0
+fi
+
 # Hyprland can miss a single query mid-reconfigure, so only a compositor that
 # stays silent counts as gone.
 stub_hyprctl 1