Test the managed agent's direct-mode launch without privileges #601

Follow-up to #561, part of #358.

#561 deletes scripts/test_managed_agent.py and the C-backed managed-agent classes of scripts/test_nvx_tools.py, and ports their cases to nvx-rs. The remaining cases need the real direct-mode launch, which no unprivileged test can run today:

• TestSystem::spawn in nvx-rs/src/guest/managed_agent/seam.rs returns ENOSYS, so the dispatch tests stop before a workload starts.
• The child's setgroups, setegid, seteuid, and chdir calls in nvx-rs/src/guest/sys/spawn.rs run after fork and bypass the System seam, so a non-root test fails at setgroups before it reaches the directory check.

The C harnesses stubbed those calls at link time and ran a setpriv shim. These cases remain to port, from ManagedAgentWorkingDirectoryTests and ManagedAgentStopTests (git show 8142d4e54~1:scripts/test_nvx_tools.py):

• Working-directory refusals. A missing directory (ENOENT), a regular file (ENOTDIR), and a directory that the workload cannot search (EACCES) each print nvx-managed-agent: cannot enter working directory DIR: STRERROR on the workload's stderr, then answer APP_ERROR(errno, "cwd-failed"), and run nothing. This is the guest side of FEATURE_EXEC_CWD.
• Identity failure. A setgroups failure answers APP_ERROR(125, "launch-failed") and runs nothing.
• Checked directory. A symbolic link retargeted, or a directory renamed, between the check and the exec still starts the workload in the directory that was checked.
• End-to-end PWD. The default working directory is /; a requested directory sets both the physical directory and PWD; a symbolic link keeps its name in PWD, while link/. gives the physical path; an exact environment controls PWD; a layered environment keeps the agent's PWD.
• Sandbox stop. In sandbox mode, STOP answers STOPPED, and the agent process then exits 0.

What is needed:

1. A fork-safe, test-only way to make the identity calls in spawn.rs succeed or fail without privileges, as the C harness's link-time stubs did.
2. A setpriv shim through Paths.setpriv that can change the file system between the directory check and the exec.
3. A scripted or real spawn path in the dispatch test harness.
4. A pseudo-terminal helper in nvx-rs/tests/guest_tools.rs that drives a real agent through RESET and STOP, then reaps it.

Running these tests as root in CI would avoid (1) for the success paths, but unprivileged developers would then skip them.