Give a handed-over directory through no link on every apply, not only the first (hq issue 356, review)

After the first apply the record is no longer used as found, so the directory read as the mesh's own and later applies set its mode and owner by path: a parent swapped for a link after the hand-over took carried root's chmod and chown to its target. The hand-over is now checked before that shortcut, so a handed-over directory always goes through applyHandedOver. The test swaps the parent and the grandparent after an apply already gave the directory its mode; both cases fail with the old order.

internal/apply/apply.go

@@ -1045,13 +1045,16 @@ func applyDirectory(r *declaration.Directory, previous store.Applied, wasBefore
 	if existed && !before.IsDir() {
 		return out, fmt.Errorf("%s exists and is not a directory", r.Path)
 	}
+	// Handed to the mesh by the operator (`nox node hand-over`, or `hand-over` at the machine): given the declared
+	// owner and mode through a descriptor that followed no link (giveHandedOver) — **on every apply, not only the
+	// first** (review of issue 356). After the first, the record is no longer used as found and would read as the
+	// mesh's own, whose mode and owner are set by path; a parent swapped for a link after that would carry root's
+	// chmod and chown to its target.
+	if existed && HandedOver()[handOverKey(r.ID, r.Path)] {
+		return applyHandedOver(r, out, mode)
+	}
 	if existed && wasBefore {
 		ours := previous.Target != "" && filepath.Clean(previous.Target) == filepath.Clean(r.Path) && !previous.AsFound
-		// Or handed to the mesh by the operator (`nox node hand-over`, or `hand-over` at the machine): then it is
-		// given the declared owner and mode — through a descriptor that followed no link (giveHandedOver).
-		if !ours && HandedOver()[handOverKey(r.ID, r.Path)] {
-			return applyHandedOver(r, out, mode)
-		}
 		if !ours {
 			owned, err := ownedBy(r.Path, r.Owner)
 			if err != nil {