feat(execd): add preStart and periodic lifecycle hooks

[jianpingpei]

Summary

• Add the execd runtime portion of lifecycle hooks using the internal OPEN_SANDBOX_LIFECYCLE transport.
• Start the execd HTTP service before optional preStart, then start periodic hooks and release the user process only after preStart succeeds.
• In init mode, prepare PID 1/reaper duties first, serve HTTP, run preStart, and only then launch the supervised user entrypoint.
• Run optional non-overlapping periodic hooks through execd's init-reaper-aware managed process path.
• Persist lifecycle configuration atomically at $HOME/.execd/lifecycle.toml; EXECD_LIFECYCLE_CONFIG remains an exact explicit override.
• Bound bootstrap synchronization and preStart shutdown with fail-closed TERM/KILL watchdogs, private synchronization files, and late-success protection.
• Strip internal lifecycle transport variables before user execution and document that hooks are trusted setup/maintenance code, not a security boundary.
• Scope is execd only; Docker provider, server API, SDKs, PATCH, and other hooks are intentionally excluded.

Related to #1542.

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Commands and verification:

• go test -count=1 -race ./pkg/lifecycle ./pkg/runtime .
• go vet ./...
• go mod tidy -diff
• golangci-lint v1.64.8 run ./...
• bash -n bootstrap.sh tests/lifecycle.sh and dash -n bootstrap.sh
• bash tests/lifecycle.sh
• Linux/Windows amd64/arm64 cross-builds
• Linux WNOWAIT managed-command barrier regression tests in an Ubuntu container
• sh, dash, and bash: 500 immediate watchdog start/stop cycles each, with no residual sleep process
• Closed-stderr, inherited-trap, and ready-file failure probes in sh, dash, and bash
• Real local bootstrap E2E: /ping was available during preStart; periodic hooks and the user command started only after preStart; internal lifecycle env was absent from user work
• Real Linux init-mode E2E: /ping was available during preStart; the supervised entrypoint started only afterward; TERM during preStart skipped the entrypoint and exited cleanly
• Init mode without an entrypoint exited cleanly on TERM

The full go test ./pkg/... suite still has the existing macOS /var -> /private/var pkg/isolation failures; the same failures reproduce on the unchanged baseline. CI runs this suite on Linux.

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2775a5d373

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".