fix: harden party_self_path; pin (U,R) ACL format; widen breakage comments

tests/96-unauthorized.bats

@@ -107,3 +107,25 @@ STUB
   [[ "$output" == *"read-only"* ]]
   [[ "$output" == *"attach-session -r -t fiesta"* ]]
 }
+
+@test "read-only invitee (U,R) flag format also falls back to passive" {
+  # tmux refuses new-session from a read-only client ("client is
+  # read-only", exit 1 — verified 3.3a/3.5a), so an active join for an
+  # -r invitee died mid-command under set -eu. cmd_join must detect the
+  # R flag on its own ACL line and attach passive instead. The unquoted
+  # STUB delimiter is deliberate: $USER expands at write time, \$* at
+  # run time.
+  cat > "$PARTY_TMP/tmux-ro" <<STUB
+#!/bin/sh
+case "\$*" in
+  *"server-access -l"*) printf '%s (U,R)\nsomehost (W)\n' "$USER"; exit 0 ;;
+esac
+exit 0
+STUB
+  chmod +x "$PARTY_TMP/tmux-ro"
+  export PARTY_TMUX="$PARTY_TMP/tmux-ro"
+  PARTY_DRY_RUN=1 run "$PARTY_BIN" join fiesta
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"read-only"* ]]
+  [[ "$output" == *"attach-session -r -t fiesta"* ]]
+}