LATX, fix: Support CEF sandbox isolation

[y347812075]

Summary

• support CEF user, PID, network, and shared-filesystem namespace clone paths
• preserve and rebuild QEMU RCU state across fork and raw clone operations
• evaluate x86 seccomp-BPF programs at the guest syscall boundary
• provide complete SIGSYS metadata for CEF broker traps
• keep the implementation buildable with older seccomp UAPI headers

Root cause

LATX rejected the namespace flags used by the CEF zygote before reaching the
host kernel. After namespace creation was enabled, CEF still could not install
its x86 seccomp filters because applying those filters to the LoongArch host
would inspect the wrong syscall ABI and could restrict translator helper
threads. Brokered SECCOMP_RET_TRAP actions also require the trap ID and guest
syscall context in siginfo.

This change creates the requested host namespaces while maintaining QEMU child
state, and interprets seccomp filters against guest syscall numbers and
arguments before syscall translation.

Compatibility

SECCOMP_RET_USER_NOTIF is conditionally defined for Linux 4.19-era userspace
headers. User notification and listener FDs remain unsupported and return
ENOSYS; the fallback only provides the stable UAPI action value needed to
compile the existing unsupported-action path.

Validation

• ./latxbuild/build64.sh
• ./latxbuild/build32.sh
• Linux 4.19 old-world ./latxbuild/build64.sh
• old-world CEF application launch with LATX_AOT=0 LATX_KZT=0

The old-world run remained active for 20 seconds and created the expected
zygote, chrome-sandbox, and network-service processes. The logs contained no
clone EINVAL, debugger startup, rejected BPF filter, unexpected SIGSYS, or
startup SIGTRAP error.

[y347812075]

Superseded by #349. The replacement is based on the latest master, includes the completed namespace fix, and excludes test-report documentation.