A copy is a new program, which macOS checks before its first exec; the
host's init ran it inside the test's minute. Timed here with load ~130
and syspolicyd not pegged: a fresh copy's first `--version` took
0.9-1.6s, a hard link of the same bun 0.04-0.3s; with syspolicyd busy
the same check took 26-55s a program in #1284. Where no link can be
made (another filesystem), the copy is run once before the minute starts.
Run in Docker (golang:1.26.8, linux/arm64, bun 1.4.2): -count=3 of the
test with bun on a bind mount (copy path) and beside HOME (link path),
all PASS; go test -tags nogui ./internal/plugin ok; go vet for linux,
windows and darwin clean. Not run: the test on macOS itself (Go tests
are kept off this Mac while syspolicyd is overloaded), so the red under
a slow first-run check is shown by the timings above, not by a failing run.