LATX, fix: Support CEF sandbox isolation

[y347812075]

Summary

• support the user, PID, network, and shared-filesystem namespace clone paths used by Chromium/CEF
• preserve and rebuild QEMU RCU state across fork, raw clone, nested user namespace, and exec transitions
• evaluate x86 seccomp-BPF filters at the guest syscall boundary instead of applying them to LoongArch host syscalls
• provide complete guest SIGSYS metadata for brokered seccomp traps
• add integration coverage for nested namespace setup and exec after namespace sandbox initialization

Root cause

LATX rejected the namespace flags used by Chromium zygotes before reaching the host kernel. Once namespace creation was enabled, applying the guest seccomp filter directly to the LoongArch translator would inspect the wrong syscall ABI and could restrict translator helper threads.

Chromium also relies on a single-threaded namespace child, nested user namespace mappings, and correct process state after exec. Incomplete child-state reconstruction left some applications unable to finish sandbox initialization even after the initial clone call succeeded.

Implementation

• create the requested host namespaces while rebuilding QEMU child and RCU state
• keep namespace sandbox children single-threaded through nested setup and exec
• interpret classic x86 seccomp-BPF programs against guest syscall numbers and arguments
• synthesize guest-visible SIGSYS information for SECCOMP_RET_TRAP
• keep unsupported seccomp actions, including listener/user notification paths, rejected explicitly

Validation

• based on upstream master at bc1ca744700e5b73ed8b71f022317ebf7f1ff54a
• ./latxbuild/build64.sh -c
• ./latxbuild/build32.sh -c
• tests/integration/test-cef-userns-nested.sh: PASS
• tests/integration/test-cef-userns-exec.sh: PASS
• 14 Chromium/CEF/Electron application samples start without --no-sandbox on the current environment
• the same 14 samples build and start without --no-sandbox on Loongnix 20 old-world; default AOT/KZT repeat also passed

This PR replaces #344. Pure test reports and workflow documents are intentionally not included in the patch series.