fix(s3): starting a member's workspace makes its missing folder, as the member

v2.7.3's ENOCWD left a new member no web path to a first project: their
home is no workspace (EFOLDER) and a not-yet-existing folder could not
start. run-as.makeMemberFolder: mkdir -p through write-as, AS the member,
only inside their own home (never the home itself, never a host folder,
never for a member with no account). Test: server-s3-lanes.

server/__tests__/server-s3-lanes.test.js

@@ -173,3 +173,22 @@ describe("an analyst's workspace is theirs, like a developer's", () => {
     }
   });
 });
+
+describe("a member's new project folder", () => {
+  it("is made as the member, and nothing else is made for anyone", () => {
+    const { fakeSudo } = require("./fixtures/fake-sudo");
+    const sudo = fakeSudo();
+    runAs.__setExecImpl(sudo.exec);
+    const fresh = path.join(USERS, "mia", "brand-new", "sub");
+    assert.equal(runAs.makeMemberFolder(fresh), true);
+    assert.ok(fs.statSync(fresh).isDirectory());
+    const call = sudo.calls.find((c) => c.includes("/opt/agenthub/libexec/write-as"));
+    assert.ok(call && call.includes("ah-mia") && call.includes(fresh) && call.includes("mkdir"));
+    sudo.calls.length = 0;
+    assert.equal(runAs.makeMemberFolder(path.join(USERS, "mia")), false, "the home itself");
+    assert.equal(runAs.makeMemberFolder(path.join(TMP, "host-new")), false, "not a member's");
+    assert.equal(runAs.makeMemberFolder(path.join(USERS, "nobody", "x")), false, "no account");
+    assert.deepEqual(sudo.calls, []);
+    assert.equal(fs.existsSync(path.join(TMP, "host-new")), false);
+  });
+});