Keep Linux Swift compiler spawning inside the supervised process group

[tolgaergin]

Linux Swift publication fails before upload because SwiftPM requests setpgid(0, 0) while starting its compiler, and the sandbox returns EPERM. A real Swift 6.3.3 reproduction confirms the failure.

Enable a Swift-inspection-only seccomp mode that acknowledges this exact call without changing the process group. Compiler descendants remain in the supervisor group for deadline and exit cleanup. Explicit PID/group changes, new sessions, and x32 group syscalls remain denied. Other lifecycle sandboxes retain their existing behavior.

Add process-group and cleanup regressions, and run the existing native Swift publication workflow in Linux PR CI so this path can no longer be skipped by default.

Validation on Linux ARM64, Rust 1.94.0, with an isolated Cargo target:

• Regression failed before the fix; native Swift publication and all six inspection tests passed afterward.
• Workspace clippy (--all-targets --locked -- -D warnings), format, and build passed.
• 6,214 library/integration tests, 5,109 serial CLI unit tests, and 97 CLI surface tests passed. The test-only managed-policy override isolates an existing policy on the local VM.
• All 16 CI helper/installer/npm check commands passed.
• Full isolated gate: 14,200 passed, 21 configured skips. Audit-scale fixture: 1 passed. All cross-platform PR CI checks passed, including native Linux Swift publication, macOS, Windows, musl, HTTP/3, and lint.

Finding totals: 1 verified and fixed, 0 rejected, 0 blocked, 0 pending findings. All required validation passed.

Required for the full website release certification in https://github.com/tolgaergin/a-package-manager/pull/185. No CLI version or publication workflow changes.

Generated by OpenAI Codex (GPT-6) using the Codex agent harness.