[ikeago]

Problem

In EXECVE mode with a PID namespace, pid::initNs() returned success immediately
after cloning the permanent dummy init. The child logged and continued if
PR_SET_PDEATHSIG, PR_SET_DUMPABLE, or its SIGCHLD disposition could not be
configured, so nsjail could launch the requested workload without knowing that
the namespace init lacked expected lifecycle or isolation properties.

Change

Add a close-on-exec status pipe between the caller and dummy init. The caller now
waits for an explicit ready byte and kills/reaps the dummy init if setup fails.
The child treats the three required setup operations as fatal; setting its process
name remains best-effort.

Add an LD_PRELOAD test helper that injects each failure only in the cloned dummy
init. On the unmodified baseline, all three cases still launch the workload and
return 0. With this change, each returns 255.

Validation

• Official Dockerfile clean build (make clean && make)
• C++20 helper build with -Wall -Wextra -Werror
• Normal -Me execution: 0
• Injected PR_SET_PDEATHSIG failure: 255
• Injected PR_SET_DUMPABLE failure: 255
• Injected sigaction(SIGCHLD) failure: 255
• Existing EXECVE and command-line/unit checks through the environment-dependent
  supplementary-group test
• clang-format --dry-run --Werror
• git diff --check

The complete make test run stops at the existing supplementary-group test in
the privileged Docker environment: it expects 255 but returns 0 under that
container capability configuration. The failure occurs before the new Makefile
cases, which were also run directly and passed.

AI assistance disclosure: Codex assisted with source review, implementation,
test development, and drafting. The contributor reviewed the resulting patch and
is responsible for the submission.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.