blocker: acquire_wan_log_lock exec abort + success-path stderr silence

[lucas-albers-lz4]

Parent

Part of umbrella #242 (openwrt/luci#8992 tip 2defca544d). Blocks #209.
Introduced/exposed on the #238 BusyBox WAN-lock path.

Fact

acquire_wan_log_lock ends with:

exec 9>"$WAN_LOG_LOCK_FILE" 2>/dev/null || return 1

Three defects, all verified under dash and BusyBox ash:

1. || return 1 never runs on open failure. A redirection error on exec
   with no command aborts a POSIX non-interactive shell. Under rpcd that kills
   the plugin mid-call (no {"ok":false,"error":"lock_failed"} body); in
   prerm it can abort before the fail-open exit 0.
2. 2>/dev/null does not hide the diagnostic — redirections apply left to
   right, so 9> is attempted before stderr is reassigned.
3. On the success path 2>/dev/null sticks. Later uci / flock
   diagnostics in this process are discarded for the rest of the lifetime;
   release_wan_log_lock does not restore stderr.

Evidence

$ dash -c 'acq(){ exec 9>"/nonexistent-dir/x.lock" 2>/dev/null || return 1; }; \
    if acq; then echo acquired; else echo "acq failed"; fi; echo "still alive"'
dash: 1: cannot create /nonexistent-dir/x.lock: Directory nonexistent
# "still alive" never prints; outer exit 2

$ busybox sh -c '...same...'
sh: can't create /nonexistent-dir/x.lock: nonexistent directory
# "still alive" never prints; outer exit 1

Success-path stderr silence: after a successful exec 9>lock 2>/dev/null, a
later echo test >&2 produces no stderr output.

Reviewer-suggested probe works:

( exec 9>>"$WAN_LOG_LOCK_FILE" ) 2>/dev/null || return 1
exec 9>>"$WAN_LOG_LOCK_FILE"

Fail path returns 1 and keeps the shell alive; success path keeps stderr.

Impact

WAN enable/disable can return an empty rpcd body instead of a structured error;
uninstall restore can abort early; successful lock holders lose stderr for the
rest of the call. Contract comment ("fails closed only if lock cannot be opened")
is false today.

Size

S — subshell probe + >> (or equivalent); host test for fail path that
asserts the shell survives. Est. 45–90 min.

Acceptance

• Failed lock open returns 1 without aborting dash / BusyBox ash
• Success path does not permanently redirect fd 2 to /dev/null
• enable_wan_logging / disable_wan_logging still emit JSON on lock failure
• Host test covers the fail path; ./scripts/fwlive-test.sh green

[lucas-albers-lz4]

Fixed on master in 39e83a8 (#247); luci recut 593ce11d20.