fix(recovery): distinguish malformed paths from outside-folder denial

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

tools/bootstrap-recovery/identity-credential-setup.py

@@ -157,6 +157,14 @@ def boundary(client,auth,token,action,receipt):
         receipt['boundary_phase']='deny_parent_path'
         status,_=request(client,offsite.BASE+'%2e%2e/r01-net-kingdom-pg/',(token,''))
         receipt['parent_probe_status']=status
+        if status not in (400,401,403,404):raise Refused()
+        receipt['parent_path_rejected']=True
+        # A malformed-path400 proves request rejection, not authorization.
+        # Separately probe a known existing account folder with only this share
+        # token: it must not authenticate as the Backup account.
+        receipt['boundary_phase']='deny_other_account_folder'
+        status,_=request(client,offsite.HOST+'/remote.php/dav/files/Backup/r01-net-kingdom-pg/',(token,''))
+        receipt['other_account_folder_status']=status
         if status not in (401,403,404):raise Refused()
         receipt['provider_boundary_verified']=True
     finally: