Don't coalesce all errors into ENOENT.  At least identify EACCES.
All callers should be handling this case already, as the POSIX
`lstat` will return this.