kernel: keep passed pipe and socket descriptors alive

[brandonpayton]

Why

SCM_RIGHTS is the Unix socket mechanism for sending open file descriptors from one process to another. recvmsg is the receiving system call, and a queued descriptor must keep its pipe or socket endpoint alive until that transfer finishes or is discarded.

SCM_RIGHTS queued serialized pipe and socket descriptors without owning their underlying endpoint references while they were in transit. Closing the sender descriptor could therefore free a resource before recvmsg installed it. The opposite failure also existed: socket descriptors queued inside self or mutual cycles kept global pipe slots alive forever.

This is a kernel ownership bug, not a package workaround. It is also a prerequisite for named-pipe descriptor passing in #864.

What changed

• Track endpoint references owned by in-flight rights separately from externally owned readers and writers.
• Transfer each queued reference exactly once when recvmsg installs a descriptor, or release it on truncation and allocation failure.
• Mark ancillary queues reachable from live receive endpoints, follow queued socket receive edges, and reclaim only unrooted self or mutual cycles.
• Return the fitting descriptor prefix for a short control buffer, close the excess, and report MSG_CTRUNC.
• Cover live pipe and socket transfer, abandoned cycles, global slot reuse, missing and short control buffers, and partial descriptor-table exhaustion with a real Wasm guest.

This changes no ABI structure or version.

Validation

Run through scripts/dev-shell.sh on exact commit 792e8b8:

• CI-shaped kernel suite: 1155 passed.
• Focused pipe unit tests: 18 passed.
• Real Wasm SCM_RIGHTS guest regression: 1 passed.
• Release kernel build, fixture instrumentation, and wasm-validate: passed.
• Guest C warnings-as-errors build: passed.
• Host typecheck: passed.
• ABI snapshot/version gate: passed with ABI 39 unchanged.
• Committed diff check: passed.

A second independent devil review found no blocking ownership, collection, rollback, or ABI defect. Browser and external POSIX conformance suites were not run.

Follow-up boundary

The pre-existing pseudo-terminal (PTY) and ordinary-file EMFILE (file descriptor table full) rollback gap remains separate. When #864 is stacked on this change, FIFO descriptors must add explicit ownership for O_PATH, O_RDWR, and the FIFO read-only cohort rather than infer ownership only from O_ACCMODE.

Current CI dependency

The first staging run on this PR stopped before the test suites while materializing the unchanged ABI 39 package baseline. This branch and current main compute Bash cache key 9fe79ff8d7200b5b5ea10651d55dc2ed2332439d1ad1c71ec86e36c9c6cfc6f0, while the canonical ABI 39 index still points to f62b8fb529fd8ef2294e68e2a5067988c0edeb3ae88883bfcc8ac19cfe737019; 56 packages report the same stale-baseline condition.

#936 has already staged the package set for its post-merge tree (for example Bash 2844dd3e31af14bfc2af68ead82a41cca6b54297012b5d7231c719f834d35ab2) and owns promotion of that verified baseline. This PR must be rebased and rerun after #936 merges. No fetch bypass or package artifact change belongs in this kernel PR.