learn/cow: fix the two cli_test failures CI never saw; run the full workspace suite in CI

[congwang-mk]

Started as a fix for the two cli_test failures CI never saw; running the full workspace suite in CI then surfaced two deeper product bugs, both fixed here. Four fixes total plus the CI changes.

1. test_write_collapse_skips_protected: COW virtualization gap

A child under learn's workdir="/" write-opens /root/<file>. prepare_copy's confined lstat of the lower path gets EACCES (the supervisor cannot traverse 0700 /root) and treated every errno except ENOENT as an error, so the open fell through to the kernel and the child hit a real permission failure, breaking the COW promise that writes under the workdir never need real permission on the lower entry. prepare_copy now gives EACCES the same disposition execute_copy already documents (fresh empty upper file), with a 0o000-directory unit test.

2. test_learn_captures_openat2: learn granted read on "/"

The sandbox sets the child cwd to the workdir, so under learn the cwd is /; python's -c mode puts the cwd on sys.path, import ctypes lists it, and learn recorded openat("/", O_DIRECTORY) as a read grant of /, which dedup_subsumed then let swallow every other read (read = ["/"]). Reads now get the same guard the write side always had: / is never a grant, warned on stderr.

3. --uid silently degraded to 65534 on stock Ubuntu 24.04

Surfaced by the first full-suite CI run: with kernel.apparmor_restrict_unprivileged_userns=1 (the 24.04 default), unshare(CLONE_NEWUSER) yields a capability-less namespace and the child's uid_map write fails behind a let _ =, leaving the child running as the overflow uid with no indication. Mapping only runs when the caller explicitly requested an identity, so a failed map write now fails the spawn through the child's fail! path, naming the likely sysctl. CI lifts the restriction so the mapping tests exercise the real feature.

4. Supervisor deadlock: freeze racing a vfork parent

Surfaced as a CI hang and reproduced locally under CPU load (stress harness, wedged within 2 iterations). seize_and_interrupt skips tasks already in TASK_UNINTERRUPTIBLE, but the /proc state check races the tracee: a vfork parent can pass the check runnable and park in kernel_clone before the interrupt lands. The freeze then blocked in an unbounded waitpid on the supervisor loop for a task whose wait only clears when the very execve being frozen resolves. Captured live: supervisor in do_wait, vfork parent D in kernel_clone, grandchild parked in seccomp_do_user_notification.

The fix arms the interrupt first and reaps with a bounded WNOHANG loop; a task seen in D after arming becomes PendingStop (kernel-held, cannot mutate argv, traps the queued interrupt when its wait clears) and is reaped after the execve response is sent. This also narrows a small pre-existing argv-TOCTOU window: a task that passes the check runnable and then parks in D used to be skipped with nothing queued, so it could wake and run user code mid-freeze; it now carries the interrupt and traps before returning to user code. A task already in D at the pre-check is still skipped without an attachment (seizing an arbitrary uninterruptible task, e.g. one stuck on slow IO, could strand a ptrace attachment past the bounded reap), so that sliver of the window remains open. The same commit hardens the recv loop against the documented SECCOMP_IOCTL_NOTIF_RECV ENOENT race (target killed while its notification was being generated), which previously retired the whole supervisor loop.

Validation: 20/20 stress iterations clean where unfixed code wedged by iteration 2; 530 lib / 305 integration / 50 cli tests pass locally.

CI

• Run the full workspace suite (--workspace --no-fail-fast --test-threads=1): cli, ffi, and oci suites were previously never run in CI, which is how items 1 and 2 shipped invisibly.
• Lift the Ubuntu 24.04 AppArmor userns restriction so uid-mapping tests test the feature.
• Bound the test step at 20 minutes so a hang fails fast with the test name visible.

Note: the prepare_copy hunk is adjacent to changes in #162; whichever merges second needs a trivial rebase, and the semantics compose (the whiteout guard sits above the lower lstat).