fix(cubetrace): wrap Behavior::variant in behavior() helper in test call sites

Behavior is a newtype (Behavior(pub u16)), not an enum, so the 5 test
call sites that passed Behavior::PURE / Behavior::IO_HEAVY / etc. directly
to the ev() helper got type mismatch errors. Add a local behavior() wrapper
and use it at all 5 sites. Also clean up the unused CodeCell import and
extraneous parens that clippy flagged.

fix(cubesys): ls on directory paths no longer rejected by path_to_czyx

The ls handler used path_to_czyx() (which enforces "path must name a
record") to derive the ACL gate coordinate. Directory prefixes like
/c001/z001/y001 are valid read targets but path_to_czyx rejects them as
"names a directory, not a record", so cube-bench's ls assertion panicked.

Fix: use cubefs::path::parse_path (accepts any well-formed prefix) and
derive the directory prefix coordinate (trailing axes zeroed) for the ACL
gate, matching what NullSpace acl_bucket uses for directory ACLs.

Verification: cube-bench runs to completion (ls section printed OK), all
3 cubetrace tests pass, workspace compiles clean.

Co-Authored-By: Hermes Agent

cubesys/src/commands.rs

@@ -1184,7 +1184,20 @@ impl Session {
                 let dir = it.next().ok_or_else(|| "ls needs <dir>".to_string())?;
                 // R5: directory reads are metadata reads — honor the read gate
                 // so an attacker can't enumerate a victim's records by name.
-                let dir_coord = crate::path_to_czyx(dir).map_err(|e| e.to_string())?;
+                // Use parse_path (not path_to_czyx) because ls targets a
+                // directory prefix, which path_to_czyx rejects as "not a record".
+                let parsed = cubefs::path::parse_path(dir)
+                    .map_err(|e| format!("ls: bad path {dir}: {e}"))?;
+                // The ACL gate wants the directory's prefix coordinate
+                // (trailing axes zeroed) — same key the NullSpace acl_bucket
+                // uses for directory ACLs.
+                let dir_coord = match parsed.axes.len() {
+                    0 => Czyx::new(0, 0, 0, 0), // root
+                    1 => Czyx::new(parsed.axes[0], 0, 0, 0),
+                    2 => Czyx::new(parsed.axes[0], parsed.axes[1], 0, 0),
+                    3 => Czyx::new(parsed.axes[0], parsed.axes[1], parsed.axes[2], 0),
+                    _ => return Err("ls: path too deep".to_string()),
+                };
                 if let Some(msg) = self.admit_read(dir_coord) {
                     self.audit_now(OP_READ, dir_coord, false);
                     return Err(msg);