Warn about restored ownership only when an entry's owner or group differs (closes #316)

A restore by a normal user always warned that file ownership was not
preserved, even when every entry came out with its recorded owner and
group. After such a restore, the owner and group each restored entry has
on disk are now compared with the recorded ones, and the warning is
printed once if any differ. The comparison is made on disk because a new
entry does not always get the user's group: on macOS, and in a setgid
directory on Linux, it takes the group of its directory. A restore as
root never warns, as before.

Judgement call: an entry that is not on disk after the restore, such as one that failed, is not compared.
Unverified: not run on a Mac; the directory-group test uses a setgid directory on Linux and runs only as root.

Model: opus-5-5

internal/cli/config.go

@@ -333,8 +333,15 @@ func newConfigEditCommand() *cobra.Command {
 				editor = "vi"
 			}
 
+			// Run $EDITOR through the shell, as git does, so a value
+			// with arguments such as "code --wait" works. The path
+			// goes in as an argument ("$@"), not into the command
+			// text, so a path with spaces or quotes arrives whole.
+			// sh -c takes the word after the command as $0, which
+			// is why editor appears twice.
 			//nolint:gosec // G204: launching the operator's own $EDITOR is the point
-			ed := exec.CommandContext(cmd.Context(), editor, path)
+			ed := exec.CommandContext(cmd.Context(),
+				"sh", "-c", editor+` "$@"`, editor, path)
 			ed.Stdin = os.Stdin
 			ed.Stdout = os.Stdout
 			ed.Stderr = os.Stderr

internal/cli/config_test.go

@@ -647,6 +647,30 @@ func TestWriteConfigSetTightensMode(t *testing.T) {
 	}
 }
 
+// TestConfigEditEditorWithArgument checks that an $EDITOR carrying an
+// argument works and that a config path with a space reaches it whole.
+// The "editor" is cp with the replacement file as its argument, so the
+// config ends up with the replacement's content only if both arrived.
+func TestConfigEditEditorWithArgument(t *testing.T) {
+	dir := t.TempDir()
+	path := seedFile(t, dir, "my config.yml", "compression_level: 3\n")
+	edited := seedFile(t, dir, "edited.yml", "compression_level: 9\n")
+
+	setRootFlags(t, RootFlags{ConfigPath: path})
+	t.Setenv("EDITOR", "cp '"+edited+"'")
+
+	mustExecute(t, newConfigEditCommand())
+
+	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+	if err != nil {
+		t.Fatalf("reading config back: %v", err)
+	}
+
+	if string(data) != "compression_level: 9\n" {
+		t.Errorf("config after edit = %q, want the edited content", data)
+	}
+}
+
 func splitPath(s string) []string {
 	return strings.Split(s, ".")
 }