fix(runner): strip clone_newcgroup when cgroups are disabled

[busla]

Summary

When cgroup v2 delegation is unavailable (e.g. inside AWS Lambda MicroVMs), entrypoint.sh strips cgroup_* directives into a fallback config /tmp/sandbox-no-cgroup.cfg. However, clone_newcgroup: true was left in the config.

In NsJail, when clone_newcgroup is true without use_cgroupv2, NsJail unconditionally attempts to create a cgroup v1 directory under /sys/fs/cgroup/memory/NSJAIL/NSJAIL.<pid>. On modern Linux kernels (AL2023, Debian, etc.), cgroup v1 does not exist, causing mkdir() to fail with No such file or directory and NsJail to terminate with exit code 255.

Fix

1. Ensure that if SANDBOX_USE_CGROUPV2 != true or cgroup v2 setup fails, both cgroup_* and clone_newcgroup lines are stripped from the NsJail configuration.
2. Fix smoke test directory permissions so the non-root mapped UID can access /mnt/data.

[busla]

Superseded by #4. The fix is retained in the merge branch, which is based on fix/nsjail-no-cgroup-clone.