Compat tests: dry-run the harness, and say so when the admin can't log in

None of the eight had ever executed, so all eight ran against an empty store
with synthetic inputs. The plumbing works: the documented JSON shapes parse,
and NO_INSERT stops each one before the harness touches the store, which a
sentinel file in each store directory confirmed — it survived every run,
including the one launched without NO_INSERT.

Two things the runbook got wrong, both of which would have cost a day on the
day the copy exists:

- TMPDIR is the copy's parent, not the copy. The harness opens
  $TMPDIR/<test name>, so a TMPDIR pointing at the copy gets an empty store
  created beside it and the test calls INBUXA's data missing.
- masked_email_compat and undelete_compat need INBUXA_COMPAT_MASKS and
  INBUXA_COMPAT_ARCHIVED, which only the tests' doc comments mentioned.

Every run ended on a 401 raised as "Missing list in response", which reads
as INBUXA's data being wrong when the login is what's wrong. Each test now
authenticates once first and names the variable that failed.

tests/src/directory/per_domain.rs

@@ -494,6 +494,8 @@ pub async fn per_domain_directory_compat() {
         "Compat admin",
         Id::from(u32::MAX),
     );
+
+    admin.assert_authenticates("INBUXA_COMPAT_ADMIN").await;
     let domains = admin
         .jmap_method_call("x:Domain/get", json!({"ids": null}))
         .await;