EXT-17: isolate Burrito musl loader per user - #194

Rework summary:

• Confirmed there were no review comments or requested changes on the newly opened PR.
• Updated the two-user regression to use each account's configured home via sudo -H, keeping the test environment faithful without overriding HOME manually.
• Re-ran bash -n, ShellCheck, and the full mix ci gate (346 tests); all passed.
• Pushed commit 804e678 without force-pushing.

Rework run 3 addresses every requested review item:

• Fixed assert_private_runtime so each command and comparison explicitly returns failure, removed assertion capture through command substitution, and added an intentional mode-0701 corruption case that proves the helper fails.
• Added Burrito Linux shared-loader regression to the open-PR CI workflow. It prepares the musl NIFs, compiles the patched Zig wrapper as a native linux_x86_64 Burrito release, and executes the two-account packaged regression before merge.
• Added an atomically published 0600 interpreter marker containing the marker version, full loader SHA-256, and deterministic private path. Warm launches validate it and skip the release walk; invalid markers rescan and repair. The packaged regression uses an unreadable sentinel to prove both fast-path and invalid-marker behavior.

Local verification: mix ci (346 app tests), warning-as-error compiles, 12 root tests, focused release tests, Bash syntax, ShellCheck, YAML parsing, git diff --check, and a real Zig 0.16.0 x86_64 Burrito build all passed. The managed sandbox denies sudo, so the exact two-UID execution is now enforced by the new PR check.