fix: reorder Kata CI gate before full suite + fix 4 flaky sandbox tests

[sabbour]

Summary

The .NET tests job runs the full ~3,500-test suite (~6.9 min avg) BEFORE the ~40-test Kata runtime gate (~11s). When the gate fails, ~6.9 minutes of otherwise-passing work is discarded.

Changes

Production fix

• \KataBwrapExecutor: bwrap --new-session\ calls \setsid()\ in the child after fork, creating a short window where the child still shares the executor's process group. This was a hard throw; converted to a \continue\ so the existing 10-second startup timeout covers the genuine misconfiguration case instead of a transient scheduling window.

CI structural fix

• Reordered the \dotnet-tests\ job: the Kata runtime gate now runs immediately after restore+build, BEFORE the full suite. A broken sandbox runtime now fails the job in under 2 minutes instead of ~8.
• Wrapped the Kata gate step (only) in
  ick-fields/retry@v3\ (\max_attempts: 2) to absorb runner-level flakiness (apt-get network hiccups, transient namespace setup) without masking real test failures. The full suite step is NOT retried.
• Split
  ode scripts/ci/validate.mjs --profile ci --area dotnet\ into explicit restore/build/test steps (documented in CONTRIBUTING.md as the equivalent locked-restore/one-build/test-exact-outputs trio) so the Kata gate can reuse the same build output ahead of the full suite.

Flaky test fixes

1. *\KataPreviewStop_SignalsActualSandboxProcessGroupWithTerm* — polls for the TERM-handler's marker file content instead of reading it once immediately after \StopPreviewProcessAsync\ returns (the sidecar Ack only proves the signal was sent, not that the trap's file write has landed on disk). Complements the production fix above.
2. *\ImageBuild_BecomesSupportedOnlyWhenARealBuilderAnswers* — the test's socket listener now accepts on a dedicated background \Thread\ instead of \Task.Run, removing ThreadPool-scheduling delay from the probe's fixed 750ms receive timeout.
3. *\LinkedWorktreeReadOperationsAndPlatformCommitRemainFunctional* — separates the (non-idempotent) file append from the (idempotent) git status/diff read, and polls the read up to 3 attempts to absorb the narrow window where a freshly-created worktree admin dir isn't yet fully resolved by the bwrap mount plan.
4. *\SpawnedProcess_StreamsItsOwnStdoutToTheSupervisor* — polls a bounded number of stdout lines for the expected one instead of asserting the very first line read is it, absorbing shell/setsid startup chatter.

Changesets

• .changeset/kata-setsid-race-fix.md\
• .changeset/ci-kata-gate-fix.md\

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com