fix(supervisor): tolerate non-empty bounding set when CAP_SETPCAP is unavailable

[waynesun09]

Summary

Fixes #2069

On rootless Podman (and other user-namespace environments), Ubuntu 24.04's
apparmor_restrict_unprivileged_userns=1 policy blocks prctl(PR_CAPBSET_DROP)
even when CAP_SETPCAP is nominally granted. This causes drop_capability_bounding_set()
to fail with EPERM when the bounding set is non-empty, crashing the supervisor
during sandbox creation.

• Adds a new match arm in validate_capability_bounding_set_clear() for
  EPERM with a non-empty bounding set — logs a warning and continues,
  relying on seccomp and Landlock for confinement
• Adds a rootless-caps CI job in branch-checks.yml that runs the
  supervisor capability tests as an unprivileged user on a bare
  ubuntu-24.04 runner (AppArmor enforcing, no CAP_SETPCAP)

Related: #2068

Changes

crates/openshell-supervisor-process/src/process.rs

• New match arm between the existing EPERM + empty bounding set and the
  catch-all Err(err) arms: when EPERM is returned and the bounding set
  is non-empty, emit a warn!() and return Ok(())
• Renamed test capability_bounding_set_clear_rejects_nonempty_eperm →
  capability_bounding_set_clear_tolerates_nonempty_eperm, now asserts is_ok()
• Simplified drop_privileges_succeeds_for_current_group — unconditionally
  asserts success regardless of CAP_SETPCAP availability

.github/workflows/branch-checks.yml

• New rootless-caps job: creates an unprivileged testuser, runs
  cargo test -p openshell-supervisor-process --lib -- capability_bounding drop_privileges
  under that user on the bare runner. This exercises the exact EPERM + non-empty
  code path that caused the crash.

Testing

• Unit tests pass locally (cargo test -p openshell-supervisor-process)
• The new rootless-caps CI job was verified on a fork:
  https://github.com/waynesun09/OpenShell/actions/runs/28475854485
  • All capability_bounding and drop_privileges tests pass as unprivileged user
  • Confirms the fix handles EPERM correctly on ubuntu-24.04 with AppArmor
• The fix does not change behavior when CAP_SETPCAP is available (privileged CI)

Checklist

• Conventional Commits format
• Signed-off-by (DCO)
• No unrelated changes
• Tests updated to match new behavior
• CI regression test added

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[github-actions]

Thank you for your interest in contributing to OpenShell, @waynesun09.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.