EXT-17: isolate Burrito musl loader per user

[ruby-automation]

Summary

• patch Burrito 1.6.0 at release time to install its embedded musl loader in a UID-scoped, owner-only runtime directory
• validate loader ownership, file type, permissions, and exact embedded bytes without following symlinks
• atomically rewrite extracted ERTS ELF interpreters away from the legacy shared path and recover after temporary-directory cleanup
• add fail-closed/idempotence/CRLF unit coverage and a native Linux regression using two unprivileged users, stale loaders, and hostile pre-positioning

Linear: https://linear.app/the-rubyists/issue/EXT-17/burrito-musl-loader-fails-across-users-with-accessdenied

Verification

• mix ci: 346 passed; dependency audits, format, strict Credo, usage rules all passed
• root MIX_ENV=test mix compile --warnings-as-errors: passed
• root mix test: 12 passed
• final linux_x86_64 Burrito build: passed
• packaged erlexec and beam.smp both use the verified private interpreter; the stale shared loader is ignored
• bash -n and shellcheck on the release regression: passed

[ruby-automation]

Rework summary:

• Confirmed there were no review comments or requested changes on the newly opened PR.
• Updated the two-user regression to use each account's configured home via sudo -H, keeping the test environment faithful without overriding HOME manually.
• Re-ran bash -n, ShellCheck, and the full mix ci gate (346 tests); all passed.
• Pushed commit 804e678 without force-pushing.

Nope

[bougyman]

The implementation itself convincingly addresses the reported shared-loader trust boundary, but the required regression does not currently enforce several of its central assertions, and no pre-merge check compiles or runs the injected Zig repair. Fix the shell assertion semantics and gate the packaged wrapper before merge; the full-tree startup scan should also be reduced or explicitly justified with performance evidence.

[ruby-automation]

Rework run 3 addresses every requested review item:

• Fixed assert_private_runtime so each command and comparison explicitly returns failure, removed assertion capture through command substitution, and added an intentional mode-0701 corruption case that proves the helper fails.
• Added Burrito Linux shared-loader regression to the open-PR CI workflow. It prepares the musl NIFs, compiles the patched Zig wrapper as a native linux_x86_64 Burrito release, and executes the two-account packaged regression before merge.
• Added an atomically published 0600 interpreter marker containing the marker version, full loader SHA-256, and deterministic private path. Warm launches validate it and skip the release walk; invalid markers rescan and repair. The packaged regression uses an unreadable sentinel to prove both fast-path and invalid-marker behavior.

Local verification: mix ci (346 app tests), warning-as-error compiles, 12 root tests, focused release tests, Bash syntax, ShellCheck, YAML parsing, git diff --check, and a real Zig 0.16.0 x86_64 Burrito build all passed. The managed sandbox denies sudo, so the exact two-UID execution is now enforced by the new PR check.