linux: pass an over-long bwrap profile through --args - #504

The wrapped command is one `sh -c` argument, and Linux caps a single argv
element at 128 KiB (MAX_ARG_STRLEN), so a profile with enough mounts
failed every spawn with an opaque E2BIG before the shell started.

When the rendered line would exceed the cap, the string form hands the
options to bwrap through `--args 3 -- <shell> -c <script> 3<file`,
NUL-separated in a temporary file that is removed with the other
per-command artifacts; bwrap reads and closes the fd while parsing, before
the command starts. Below the cap the command line is unchanged, so
callers need no change either way.

wrapCommandWithSandboxLinux takes concrete paths; glob expansion happens in
SandboxManager, so the pattern the test passed matched nothing and no
mask was emitted on Linux. Pass the created files themselves.

The 2000-mount sandbox took longer than bun's 5 s default on the x86-64
runner, so the synchronous spawn was cut off with a null status. Fewer,
longer-named masks still overflow one argument, the runner's tmpdir is
scanned one level deep, and the case gets a 60 s budget.

…er fd check

The overflow branch names the directory returned by the ensureBwrapArgsDir()
call made before the filesystem arguments were generated — the one this
profile ro-binds — instead of calling it a second time, and the fd
collision test reads the optional match in one expression.

One conflict in src/sandbox/linux-sandbox-utils.ts: main (anthropics#505) and 
this branch each added top-level declarations at the same spot 
(capabilityArgs and the --args helpers); both are kept.

…mple command, and refuse what bwrap cannot run

The directory is created before the first sandbox is wrapped and never a
second time. A sandbox wrapped earlier would lack a new directory's bind,
and the library cannot tell whether it is still running: reset() does not
end sandboxes and the active count is only as exact as its caller, so the
latch that waited for the count to drain could be cleared by reset(),
skipped when reset() came first, or left set for good by the wrap's own
catch. Now the directory is identified by device, inode, owner and mode
(a same-path replacement was accepted by existsSync), and once it cannot
be created or is found removed or replaced, profiles stop binding it and
an over-long one is refused, with the reason, until the process restarts.
A profile that fits no longer fails because tmpdir is unusable.

The directory is bound by its resolved path, since bwrap before 0.12
cannot follow an absolute symlink in a bind destination, and its name
starts with a dot, so `rm -rf "$TMPDIR"/*` inside a sandbox does not trip
on the mount point. The bind is pushed at the call site;
generateFilesystemArgs is as it was.

Past the cap the string was a brace group that exec'd the caller's shell:
a prefix was a syntax error, a suffix was skipped, csh could not run it,
and `command rm` was looked up in PATH by the unsandboxed shell. It is now
`/bin/sh -c '<open, unlink, exec>' srt-args <file> bwrap ...`, a simple
command like the inline form, with rm from /usr/bin or /bin. Only the
mounts go to the file, which is readable in the process's other
sandboxes; the environment and the command stay on the line, with
`--args` at the mounts' position.

The cap is 32 pages, read from AT_PAGESZ, so a 64 KiB-page kernel keeps
its 2 MiB, and the switch leaves 4 KiB for a prefix of the caller's own.
A command too long for one argument by itself, a profile past bwrap's
9000 arguments, and a mount path containing NUL (which bwrap would split
into several options) fail at wrap time with an error, before a file is
written.

Tests: every case fails on the previous commit. Process-wide state (a
replaced directory, one that vanishes mid-wrap, an unusable or symlinked
tmpdir) runs in a fresh process; the end-to-end case runs the string
between `timeout 60` and `&& echo AFTER`. The bwrap capability probe
moves to test/helpers.

…file

The file the wrapper opened at execution time was reachable by name. A
sandbox that can rename a writable directory above TMPDIR, or one launched
by another process of the same user with that tmpdir writable, could put
its own profile at that name between the wrap and the open: the read-only
bind this process placed on the directory covered neither case, and the
identity check ran at wrap time, before the window it had to cover.

The mounts now go to an unnamed file: O_TMPFILE under os.tmpdir(), or
/dev/shm when that takes none. The process keeps the descriptor open and
the string reopens it through /proc/<pid>/fd/<n>, a fresh read-only
description of the same inode at offset 0. Nothing is named at any point,
so there is nothing to substitute; reaching the descriptor needs the
wrapping process's own /proc entry, and every sandbox this library starts
has --unshare-pid and a fresh --proc /proc, so none of them sees it. That
ends the exposure the directory came with as well — a pending profile was
readable in the process's other sandboxes — along with the bind every
profile carried for it, the identity check, the latch that refused
over-long profiles until restart, and the rm in the wrapper.

When no directory takes an unnamed file, or the profile cannot be opened
again through /proc, an over-long profile is refused at wrap time with the
reason. There is no fallback to a named file: such a profile failed with
E2BIG before any of this existed, so refusing takes nothing away.

Descriptors are released where the files were removed before — when the
last sandbox of a batch is cleaned up, and at exit. A string run after
that fails in the redirection and never reaches the command.