keep the cache's key and pull token for hive-priv in a root-only directory

nix/script-tests/attic-root-facts.nix

@@ -0,0 +1,32 @@
+# `checks.script-test-attic-root-facts` — runs
+# ../host-modules/lib/attic-root-facts.nix's script, as `hive-priv-cache-facts`
+# runs it, against a stub `bao` that keeps its leaves in files. The cases are in
+# ./attic-root-facts.sh.
+#
+# What runs is the rendered script, with the directory it writes moved into the
+# test's scratch space.
+{
+  pkgs,
+  ...
+}:
+let
+  script = pkgs.writeText "attic-root-facts.sh" (
+    import ../host-modules/lib/attic-root-facts.nix { inherit (pkgs) lib; } {
+      hive = "alpha";
+      host = "cache.example";
+      dir = "@DIR@/attic";
+    }
+  );
+in
+pkgs.runCommand "hyperhive-script-test-attic-root-facts"
+  {
+    SCRIPT = script;
+    nativeBuildInputs = [
+      pkgs.coreutils
+      pkgs.gnugrep
+    ];
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./attic-root-facts.sh}
+    touch "$out"
+  ''