Defer sidecar walks to the sysroot host fallback

[Max042004]

Problem

On a case-insensitive sysroot (macOS default APFS, where the sidecar
case-folding layer is active), absolute guest paths that live outside the
sysroot became unreachable. proc_resolve_sysroot_path_flags documents the
contract: resolve inside the sysroot when the path exists there, otherwise
fall back to the literal host path so guests can still reach host resources
such as mktemp directories or /etc/resolv.conf. The sidecar walk vetoed
that fallback in two ways:

• sidecar_translate_lookup_at anchored every absolute path at the sysroot
  root and returned ENOENT as soon as an intermediate component was missing
  there; when only the final component was missing it still rewrote the path
  to ${sysroot}${path}. Either way the resolver's host-literal decision was
  overridden.
• Mutating syscalls (openat with O_CREAT, mkdirat, unlinkat,
  linkat, renameat) hit the same wall through sidecar_walk_parent_at,
  which hard-anchored the parent directory at the sysroot.

Symptom

All 27 failures in the test-matrix "musl dyn" coreutils suite on the
self-hosted runtime job (PR #91) and on any local run where the fixtures
live on a case-insensitive volume:

cat   [ FAIL ] (exit 1)   ... cat: /var/folders/.../hello.txt: No such file or directory
touch [ FAIL ] (got 1)    ... cannot touch '/var/folders/.../touched-1'
env   [ FAIL ] (got 127)  ... execve could not reach the host binary

Dynamic binaries run under --sysroot; macOS mktemp -d lives in
/var/folders/... and the sysroot only contains /var, so the walk
descended into ${sysroot}/var, failed at folders, and turned the
documented fallback into ENOENT. Static coreutils run without --sysroot
and passed, which is why only the dynamic suite failed.

Fix

Track whether the walk consulted an index mapping:

• A walk that leaves the sysroot tree without touching a mapping returns
  "no translation" (0), so the resolver's fallback decision stands.
• Beneath a mapped prefix the sysroot view stays authoritative: missing
  suffixes append literally and surface as ENOENT against the translated
  path (no index can exist under a missing directory).
• An unmapped final component is claimed only if it actually exists in the
  sysroot, restoring the fallback for paths like /etc/resolv.conf whose
  parent exists in the sysroot but whose leaf does not.

sidecar_walk_parent_at now reports a parent that resolves outside the
sysroot as a distinct verdict, and all mutation entry points hand such paths
back as SIDECAR_NOT_HANDLED to the regular translation flow.

Validation

• tests/test-matrix.sh elfuse-aarch64: 168 passed, 0 failed (was
  141/27); the remaining 4 skips are missing optional fixtures
  (base32/b2sum/numfmt applets, glibc dyn suite), unrelated to this bug.
• New regression test test-sysroot-host-fallback (wired into
  make check): 7 cases covering reads through missing intermediates,
  create/write/unlink, mkdir/rmdir, rename on host paths, the
  missing-final-component fallback, and sysroot-over-host precedence.
  Without the fix six of the seven cases fail with ENOENT.
• make check: all green (104 driver tests + host unit tests, 0 failed).
• test-case-collision and test-case-collision-fallback (12/12 both):
  the sidecar's collision compensation is unaffected.

---

Summary by cubic

Defers sidecar path walks to the resolver’s host-literal fallback on case-insensitive sysroots so absolute guest paths outside the sysroot remain reachable. Restores access to host resources (e.g., mktemp dirs, /etc/resolv.conf) and fixes the “musl dyn” coreutils failures.

• Bug Fixes
  • Lookup returns “no translation” if a walk leaves the sysroot without an index mapping; mapped prefixes stay authoritative and missing dirs surface ENOENT; unmapped final components are only claimed if they exist.
  • sidecar_walk_parent_at reports parents outside the sysroot; mutation syscalls (openat, mkdirat, unlinkat, linkat, renameat) return SIDECAR_NOT_HANDLED for the regular resolver.
  • Adds test-sysroot-host-fallback and wires it into make check; matrix now 168 passed, 0 failed (was 141/27).

^{Written for commit 1304c68. Summary will update on new commits.}

[jserv]

Thank @Max042004 for contributing!