On systems where `unshare --map-root-user` alone fails because uid_map
direct writes are blocked by the kernel (observed on util-linux 2.39.3
with non-root users), adding `--map-auto` lets unshare use the newuidmap
SUID helper with /etc/subuid delegations to set up the mapping.
This affects both the user-namespace detection probe and the actual
sandbox launch arguments. When --map-root-user already works natively,
the additional --map-auto flag is a safe no-op.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
On GitHub Actions runners, `unshare` binary exists at /usr/bin/unshare
but user namespaces (CLONE_NEWUSER) are restricted, causing `unshare
--user --map-root-user` to silently fail. This produced empty stdout
in the bash_stdout_roundtrip parity test (mock_parity_harness.rs:533).
Replace the simple `command_exists("unshare")` check with
`unshare_user_namespace_works()` that actually probes whether
`unshare --user --map-root-user true` succeeds. Result is cached
via OnceLock so the probe runs at most once per process.
Fixes: CI red on main@85c5b0e (Rust CI run 23933274144)
Einspanner123
bellman
Jobdori
Yeachan-Heo