Fix native MariaDB FUSE ownership readiness

[chubes4]

Summary

• Run MariaDB initialization and daemon as the exact verified unprivileged caller that owns the private FUSE filesystem.
• Replace marker-only descriptor readiness with the real provision/query/release lifecycle while retaining the exact cleanup handle until teardown succeeds.
• Validate post-mount UID/GID, FUSE source identity, and rw,nosuid,nodev,noexec options before initialization.
• Reconcile the branch with main v0.24.5 (0de9390e) through merge commit 6f26bee2 and preserve current runtime-service, process-group, package, and release contracts.

Final Security Review Fixes

• Require available real/effective UID and GID APIs before host access; reject root-valued IDs and real/effective set-ID mismatches before any trusted command or private-root allocation.
• Carry the same proven identity through MariaDB username resolution, ext4 root_owner, and mounted-filesystem ownership checks.
• Retain failed descriptor cleanup closures and retry the same allocation before any fresh probe. A successful retry completes the original readiness lifecycle without provisioning a second database.
• Use single-flight only for concurrent descriptor calls. Settled ready and unavailable results are immediately invalidated so temporary tool or policy changes recover.
• Bound descriptor probing and install scoped SIGINT, SIGTERM, and SIGHUP abort handlers. Interruption uses the same native cleanup path and removes handlers after execution.
• Give the shared native probe its own controller and track independent caller waiters. One aborted caller cannot cancel another; all-waiter cancellation aborts exactly one allocation, while an interrupted descriptor does not wait behind an unrelated live caller.
• Recheck interruption after native teardown, propagate the same signal through Playwright readiness, suppress normal descriptor output, and return 124 for timeout or deterministic 129/130/143 signal statuses.
• Remove abortableDelay() and browser-readiness abort listeners on both normal settlement and cancellation.

Security Compatibility

Trusted executable and ancestor resolution, fixed child PATH, private mode-0700 roots, symlink-free containment, 256 MiB/4,096-inode ext4 geometry, fixed rlimits, loopback-only least-privilege credentials, storage-engine allowlisting, bounded diagnostics, verified process-group shutdown, FUSE unmount, and root removal remain fail-closed. Descriptor discovery returns stable non-secret unavailable reasons.

Verification

• npm run build passed.
• npm run test:runtime-services passed. Coverage includes effective-root and setuid/setgid rejection with zero host commands/roots, full lifecycle readiness, mount rejection, initializer failure, teardown-race interruption, retained teardown retry without a second allocation, independent caller cancellation in both orders, all-waiter abort cleanup, signal/timeout output suppression and exit statuses, listener removal, transient unavailable recovery, and no root/process leaks.
• npm run test:playwright-browser-provenance passed, including cancellation of a pending browser provenance lookup and abort-listener removal.
• npm run test:native-mariadb-runtime-service-integration passed its fail-closed unavailable assertion: this VPS has /usr/bin/fusermount3 but no fuse2fs, so discovery returned trusted-containment-tools-unavailable without creating or leaking a private root. No complete-toolchain host proof was run in this update.
• npm run test:release-package-coverage passed.
• npm run check passed all 102 current check-group commands. Its Docker-backed disposable MySQL case reported the repository's expected skip because Docker is unavailable.
• git diff --check passed.

Final SHA: ac67b02f.

No force-push, merge, release, publish, or deploy was performed.

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode reconciled current main, implemented and reviewed the native MariaDB identity, cleanup-retention, cache, and interruption fixes, expanded deterministic and host fail-closed coverage, and ran the documented verification. Chris Huber remains responsible for every line.