test(sandbox): harden procfs binary_path tests against fork/exec race and ETXTBSY

Three tests in `procfs::tests` are flaky on arm64 CI containers:

* `binary_path_strips_deleted_suffix`, `binary_path_preserves_live_deleted_basename`
  — `std::process::Command::spawn()` returns once the child is scheduled, not once
  it has completed `exec()`. On a contended arm64 runner, reading `/proc/<pid>/exe`
  immediately after spawn can return the parent (test-harness) path for a brief
  window. The tests then assert the child's exe matches their target path and
  fail with the harness path on the left.

* `binary_path_strips_suffix_for_non_utf8_filename` — sporadically gets ETXTBSY
  on spawn despite the existing `sync_all()` + scope drop. The writer fd is
  closed, but the kernel's write-lock release races the immediately-following
  `execveat()` under load.

Adds two test helpers and applies them to the three tests:

* `wait_for_child_exec(pid, target)` polls `/proc/<pid>/exe` until the readlink's
  byte prefix matches `target`, with a 2 s deadline. Tolerates the kernel's
  `" (deleted)"` suffix on unlinked binaries.
* `spawn_retrying_on_etxtbsy(cmd)` retries `Command::spawn()` up to 20 times
  with a 50 ms backoff when it returns `ETXTBSY`. Any other spawn error
  surfaces immediately.

Both helpers are `#[cfg(target_os = "linux")]` and live in the test module;
they don't change any production behaviour. `binary_path` itself is unchanged.

Author: pimlock

crates/openshell-sandbox/src/procfs.rs

@@ -399,6 +399,55 @@ mod tests {
     use super::*;
     use std::io::Write;
 
+    /// Block until `/proc/<pid>/exe` points at `target`. `std::process::Command::spawn`
+    /// returns once the child is scheduled, not once it has completed `exec()`. On
+    /// contended runners (notably arm64 CI containers) the readlink can still return
+    /// the parent (test harness) binary for a brief window after spawn. Without this
+    /// wait, tests that inspect the child's exe path race the kernel and observe the
+    /// harness path instead of the target.
+    ///
+    /// After `remove_file`, the readlink ends with a literal `" (deleted)"` — we
+    /// compare byte-level with `starts_with` so the suffix is tolerated.
+    #[cfg(target_os = "linux")]
+    fn wait_for_child_exec(pid: i32, target: &std::path::Path) {
+        use std::os::unix::ffi::OsStrExt as _;
+        let target_bytes = target.as_os_str().as_bytes();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
+        loop {
+            if let Ok(link) = std::fs::read_link(format!("/proc/{pid}/exe"))
+                && link.as_os_str().as_bytes().starts_with(target_bytes)
+            {
+                return;
+            }
+            assert!(
+                std::time::Instant::now() < deadline,
+                "child pid {pid} did not exec into {target:?} within 2s"
+            );
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+    }
+
+    /// Spawn a command, retrying on `ETXTBSY`. A freshly-written executable can
+    /// briefly be unspawnable under concurrent test load — the writer fd has been
+    /// closed but the kernel's write-lock on the inode hasn't been released yet.
+    /// Retrying with a small backoff absorbs that window without hiding real
+    /// spawn failures.
+    #[cfg(target_os = "linux")]
+    fn spawn_retrying_on_etxtbsy(
+        mut cmd: std::process::Command,
+    ) -> std::io::Result<std::process::Child> {
+        for _ in 0..20 {
+            match cmd.spawn() {
+                Ok(child) => return Ok(child),
+                Err(e) if e.raw_os_error() == Some(libc::ETXTBSY) => {
+                    std::thread::sleep(std::time::Duration::from_millis(50));
+                }
+                Err(e) => return Err(e),
+            }
+        }
+        cmd.spawn()
+    }
+
     #[test]
     fn file_sha256_computes_correct_hash() {
         let mut tmp = tempfile::NamedTempFile::new().unwrap();
@@ -457,11 +506,11 @@ mod tests {
         // child is still running. The child keeps the exec mapping via
         // `/proc/<pid>/exe`, but readlink will now return the tainted
         // "<path> (deleted)" string.
-        let mut child = std::process::Command::new(&exe_path)
-            .arg("5")
-            .spawn()
-            .unwrap();
+        let mut cmd = std::process::Command::new(&exe_path);
+        cmd.arg("5");
+        let mut child = spawn_retrying_on_etxtbsy(cmd).unwrap();
         let pid: i32 = child.id().cast_signed();
+        wait_for_child_exec(pid, &exe_path);
         std::fs::remove_file(&exe_path).unwrap();
 
         // Sanity check: the raw readlink should contain " (deleted)".
@@ -507,11 +556,11 @@ mod tests {
         std::fs::copy("/bin/sleep", &exe_path).unwrap();
         std::fs::set_permissions(&exe_path, std::fs::Permissions::from_mode(0o755)).unwrap();
 
-        let mut child = std::process::Command::new(&exe_path)
-            .arg("5")
-            .spawn()
-            .unwrap();
+        let mut cmd = std::process::Command::new(&exe_path);
+        cmd.arg("5");
+        let mut child = spawn_retrying_on_etxtbsy(cmd).unwrap();
         let pid: i32 = child.id().cast_signed();
+        wait_for_child_exec(pid, &exe_path);
 
         // File is still linked — binary_path must return the path unchanged,
         // suffix and all.
@@ -564,11 +613,11 @@ mod tests {
             f.sync_all().expect("sync_all before exec");
         }
 
-        let mut child = std::process::Command::new(&exe_path)
-            .arg("5")
-            .spawn()
-            .unwrap();
+        let mut cmd = std::process::Command::new(&exe_path);
+        cmd.arg("5");
+        let mut child = spawn_retrying_on_etxtbsy(cmd).unwrap();
         let pid: i32 = child.id().cast_signed();
+        wait_for_child_exec(pid, &exe_path);
         std::fs::remove_file(&exe_path).unwrap();
 
         // Sanity: raw readlink ends with " (deleted)" and is not valid UTF-8.