bump-leg.py: a workflow file, the workflows directory or the leg's pin that this user cannot open is refused by name with a remedy, so the run ends in exit 2 and not a PermissionError traceback (#383)

docs/handbook.html

@@ -1314,7 +1314,10 @@ <h3>Advancing a leg</h3>
       is a root it cannot bootstrap); a dirty root; an untracked or ignored workflow file it would
       rewrite; a workflow file or the leg&rsquo;s own pin that is not UTF-8, naming each file and its
       first bad byte before anything is written (a file git does not track needs the re-save and no
-      commit); a root standing on its own tracking branch (the next step is a pull request, never a
+      commit); a workflow file, the <code>.github/workflows/</code> directory or the leg&rsquo;s pin
+      that this user cannot open, naming the path and the system&rsquo;s reason, with the same ids
+      and the remedy of making it readable and running the command again; a root standing on its
+      own tracking branch (the next step is a pull request, never a
       push to the default branch); and a validator that goes red &mdash; rolling the pin, the
       workflow files, the leg&rsquo;s checkout and the index back first, so a refusal leaves the
       tree exactly as it was found.</p>
@@ -1790,8 +1793,9 @@ <h2>For AI assistants</h2>
       refusing an untracked or ignored one it would rewrite, added (#207); the assistant rules
       saying that some scaffold refusals name a value to change, added (#288);
       <code>bump-leg.py</code> refusing a workflow file or the leg&rsquo;s pin that is not UTF-8, by
-      name, added (#289) &mdash; a page cannot name the commit that contains it, and the blob below
-      is the fact a test checks.
+      name, added (#289); <code>bump-leg.py</code> refusing a workflow file, the workflows directory
+      or the leg&rsquo;s pin that this user cannot open, by name, added (#383) &mdash; a page cannot
+      name the commit that contains it, and the blob below is the fact a test checks.
       README.md blob e8da93817b0c1a195300800373a2895c0e0280e5. Every command, flag, exit code
       and file name on this page is quoted from that README and from AGENTS.md.</p>
     </footer>