Fix rootless launches with subordinate ID maps

Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.

crates/lazaret-host-coordinator/tests/cold_start.rs

@@ -16,10 +16,13 @@ use lazaret_core::records::{
 use lazaret_host_coordinator::cold_start::{ColdStart, ColdStartInputs};
 use lazaret_host_coordinator::domain_store::HostCoordinatorDomainStore;
 use lazaret_linux::filesystem::{namespace_identity, try_exclusive_flock};
+use lazaret_linux::user_namespace::{
+    REQUIRED_SUBORDINATE_IDS, UserNamespaceIdRange, UserNamespaceMap,
+};
 use lazaret_runtime_supervisor::network::NetworkProbeRequest;
 use lazaret_runtime_supervisor::sandbox::{RootProcess, default_sandbox_layout};
 use lazaret_storage_catalog::Catalog;
-use rustix::process::getuid;
+use rustix::process::{getgid, getuid};
 
 #[test]
 fn validated_inputs_stage_one_complete_plan_and_drop_exact_runtime_artifacts() {
@@ -217,6 +220,7 @@ impl ColdStartFixture {
             invoking_uid: getuid().as_raw(),
             escalation_client,
             sandbox_init: escalation_client,
+            user_namespace_map: test_user_namespace_map(),
         }
     }
 
@@ -239,6 +243,39 @@ impl ColdStartFixture {
     }
 }
 
+fn test_user_namespace_map() -> UserNamespaceMap {
+    let uid = getuid().as_raw();
+    let gid = getgid().as_raw();
+    let subordinate_user_start = if uid < 131_072 { 131_072 } else { 1 };
+    let subordinate_group_start = if gid < 131_072 { 131_072 } else { 1 };
+    UserNamespaceMap {
+        uid: vec![
+            UserNamespaceIdRange {
+                container_id: 0,
+                parent_id: uid,
+                size: 1,
+            },
+            UserNamespaceIdRange {
+                container_id: 1,
+                parent_id: subordinate_user_start,
+                size: REQUIRED_SUBORDINATE_IDS,
+            },
+        ],
+        gid: vec![
+            UserNamespaceIdRange {
+                container_id: 0,
+                parent_id: gid,
+                size: 1,
+            },
+            UserNamespaceIdRange {
+                container_id: 1,
+                parent_id: subordinate_group_start,
+                size: REQUIRED_SUBORDINATE_IDS,
+            },
+        ],
+    }
+}
+
 fn assert_private_artifacts(bundle: &Path, control: &Path) {
     let config = bundle.join("config.json");
     let escalation_client = control.join("bin/lazaret-escalate");