[PHP] fix: preserve process environments and chown sentinel semantics

[brandonpayton]

Purpose

Keep guest environ and kernel-owned process metadata coherent across launch,
fork, and exec on Node and browser, and make chown, fchown, and fchownat
honor (uid_t)-1 / (gid_t)-1 without hiding ordinary target,
authorization, or backend behavior.

These are process-model and POSIX invariants surfaced by PHP, not PHP-specific
workarounds.

What changed

• Give the kernel the same effective initial environment as the process worker:
  Node uses the requested environment or its effective empty default, while
  browser computes its requested/default environment once and uses it on both
  sides.
• Add an instrumented guest regression covering initial environment state,
  isolated fork inheritance, exec replacement, and an explicitly empty
  envp, on both Node and Chromium.
• Resolve each chown-family unchanged-ID sentinel from authoritative file
  metadata after validating the target and authorization.
• Continue delegating same-value and all-unchanged requests so descriptor,
  backend-error, timestamp, and set-ID semantics are not bypassed.
• Add focused Rust and guest coverage for chown, fchown, and fchownat,
  and document the supported behavior and remaining authorization/flag gaps.
• Correct the libc cancellation xfail comment without changing the xfail set.

Review changes from the original PR

The original #742 head (9c02de563) combined environment, ownership, and test
rationale changes under one commit subject. It was rebuilt as three
purpose-specific commits on the exact Batch 2 tip.

The original custom scratch/snapshot environment machinery and fork-worker
reconstruction were not replayed: the aggregate already has bounded process
metadata replacement, kernel fork copies process metadata, and copied Wasm
memory preserves the live libc environment. Exec replacement and
posix_spawn metadata are likewise already owned by their aggregate kernel
paths.

The original chown implementation returned early whenever resolved IDs matched.
That shortcut could bypass authorization and suppress backend errors and inode
side effects. The repaired implementation validates and delegates instead.

ABI disposition

This constituent has no structural ABI-file change, and the structural ABI
check passes. That is not standalone ABI-compatibility clearance: it consumes
Batch 2's process-metadata contract and changes syscall-visible behavior.
Keep it quarantined in #871 for the single aggregate ABI 16→17 reconciliation
and rebuilt ABI-bound artifacts.

Validation

Passed on the repaired source tree through scripts/dev-shell.sh:

• cargo test -p kandelo --target aarch64-apple-darwin --lib: 1,076 passed
• focused chown-family Rust filter: 12 passed
• focused Node environment/chown/exec/spawn/fork set: 46 passed, 3 skipped
• real Chromium environment + chown guest specs on an isolated Vite port: 2 passed
• focused Sortix chown/fchown/fchownat/lchown: 4 passed
• bash build.sh: completed
• bash scripts/check-abi-version.sh: structurally consistent

Repository-wide cargo fmt --check is currently blocked by pre-existing Rust
formatting drift, including unrelated regions of syscalls.rs; git diff --check is clean. The full host, libc, POSIX, full Sortix, canonical-browser,
and PHP PHPT gates remain pending on the final aggregate.

View

Accept into Batch 2 only. The repaired implementation and history are
truthful, and the kernel plus focused Node/browser evidence supports the
constituent. It is not independently ready for main; ABI 17 reconciliation
and the full exact-aggregate gate remain required.