test: bind the URL assertions to the statement, not its indentation

53022b8 pushed with the suite red at 111/2 and a message claiming 113. The two
failures were real and I did not see them: I grepped only the section I had just
added and read the total with `tail -1`, which returns a blank line.

The failures were in the extractor, not in dotup. Moving the normalisation into
the retry loop changed its indentation from one tab to two, and the sed anchored
on `^\t` stopped matching -- so the eval became a no-op and the assertions
reported the doubled path as if the feature had been removed.

That is the mutation-binding doing its job: the test is coupled to dotup's real
code and noticed it moved. But coupling to leading whitespace makes any
reindentation look like a regression, so the pattern now matches the statement
with leading space allowed.

113 passed, 0 failed. The end-to-end also passes against the pushed dotup with a
wrong password sent first, which is what actually exercises the retry.

.tests/test.sh

@@ -167,7 +167,11 @@ is "…including scp-style ssh" \
 # normalisation that becomes .../bootstrap.env/bootstrap.env -- a 404 that
 # curl --fail turns into "endpoint refused the credentials", blaming the
 # password for a URL shape. Both forms must land on the same request.
-norm() { P_URL=$1; eval "$(sed -n '/^\tP_URL=\${P_URL%\//p;/^\tP_URL=\${P_URL%\/bootstrap.env}/p' $D)"
+# Indentation-agnostic on purpose: these two lines moved from function body to
+# inside the retry loop, and an anchor of `^\t` silently stopped matching, so
+# the eval became a no-op and the assertions failed as if dotup were broken.
+# Bind to the statement, not to where it happens to sit.
+norm() { P_URL=$1; eval "$(sed -n 's/^[[:space:]]*\(P_URL=\${P_URL%[^}]*}\)$/\1/p' $D)"
          printf '%s\n' "${P_URL%/}/bootstrap.env"; }
 is "a directory URL resolves to the blob" "https://h/r/bootstrap.env" \
    "$(norm 'https://h/r/')"