config-metadata script needs root perms; exit cleanly if missing