[IvanHCenalmor]

Closes #20

Most of #20 was already on main

The issue was filed on 9 Oct from a source comparison against an older LcRegistry (its line links point at a version from before the split). The day before, c659a3b had ported the Fiji/Toolkit trust checks to QuPath, and #40 (16 Oct) added the output and choice checks. Acceptance criteria against current main:

Acceptance criterion	Where it is on main	Test (gui_test_parity_trust_body.groovy)
Malformed pythonpath rejected	LcRegistry.entryProblem	trust_pythonpath_not_list, trust_pythonpath_item_not_text
Missing / invalid tools rejected	LcRegistry.schemaProblem	trust_tools_none, trust_tools_not_list, trust_tool_not_object, trust_tool_no_outputs …
Unsafe parameter identifiers rejected	schemaProblem (identifier)	trust_param_name_path, trust_param_name_space, trust_param_name_missing …
Unsupported types	LcDialog.unsupportedParameter: the tool says "this tool cannot be shown", the app's other tools stay usable (as in Fiji's usableTools and the Napari form)	gui_test_parity_host_body.groovy: unknown_type_says_so_in_the_status, unsupported_parameter_unit
Invalid cached schema structures, without crashing the form	schemaProblem; each broken app is listed under "skipped" with its reason, and the others still load	the trust_*_refused checks, trust_no_null_pointer_text_anywhere
Cached schema ownership / writability on POSIX	LcRegistry.permissionReason → fileReason(schemaFile, …)	trust_group_writable_schema, trust_schema_owner_other
Valid apps stay discoverable	load()	trust_ok_loads, trust_valid_choice_and_outputs_load, trust_sticky_folder_is_not_world_writable
Windows: which checks don't apply	README, "Trust checks" and the Windows note	—

The gap this PR closes

The owner checks (trust_owner_other, trust_schema_owner_other) never ran in CI. They need chown to a second user, and the runner had neither the user nor root, so the trust body quietly skipped them: on main's latest run it reports 51 checks of 53. So nothing in CI proved the "schema file owned by someone else is refused" rule of #20.

• qupath-gui.yml creates the user tester and sets LC_REQUIRE_OWNER_CHECKS=1.
• The trust body uses chown directly, or else sudo -n chown (passwordless sudo, as on a CI runner). With LC_REQUIRE_OWNER_CHECKS=1, an owner check that cannot be made is a failure (trust_owner_checks_can_run), not a skip. Locally, without the variable, it still skips with a NOTE, as before.
• New check: a root-owned entry in your own user folder is refused. Root may own entries only in shared folders, and the refusal uses the user-folder sentence, without "or root".
• README: the body's real check count, and how the owner checks run.

Expected in CI: the trust body reports 56 checks (53 + trust_owner_checks_can_run + the 2 root checks).

Not covered (not changed here)

• Root-owned entries accepted in a shared folder (LC_APPS_PATH or the system folder) are not tested. That would mean writing a root-owned entry into the shared registry the other bodies use.
• Nothing ran locally: the QuPath GUI tests need Linux with QuPath and Xvfb, so this PR's CI run is the test.

🤖 Generated with Claude Code