Port unshare user/mount namespace support from uruntime

[Copilot]

Implements automatic fallback to user+mount namespaces when SUID fusermount is unavailable, based on uruntime's implementation.

Changes

Core namespace handling

• try_unshare() - Creates CLONE_NEWUSER | CLONE_NEWNS with configurable UID/GID mapping
• restore_capabilities() - Restores capabilities via capget/capset syscalls after namespace entry
• try_make_mount_private() - Applies MS_REC | MS_PRIVATE to prevent mount leaks
• is_in_user_and_mount_namespace() - Detects existing namespace via /proc/self/uid_map parsing

FUSE availability enhancement

• check_fuse() - Attempts unshare when SUID fusermount detection fails
• is_suid_exe() - Validates setuid bit + owner root for fusermount binaries

User interface

# Explicit request
./app.AppImage --appimage-unshare

# Environment control
APPIMAGE_UNSHARE=1 ./app.AppImage
APPIMAGE_UNSHARE_ROOT=1 ./app.AppImage  # map to UID/GID 0
APPIMAGE_UNSHARE_UID=1000 APPIMAGE_UNSHARE_GID=1000 ./app.AppImage

Implementation notes

• Uses system capability structs (__user_cap_header_struct, __user_cap_data_struct)
• Silently ignores individual ambient capability failures (may not be available on all kernels)
• Returns true from check_fuse() even when both SUID and unshare fail to allow non-SUID fusermount attempts
• Constants defined for magic numbers (DEFAULT_LAST_CAP=39, UINT32_FULL_RANGE, UID_GID_MAP_BUFFER_SIZE)

Original prompt

Port unshare functionality from VHSgunzo/uruntime@ab5a4f7 into type2-runtime, then build the runtime and test whether it works with unshare.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[TheAssassin]

The sentence "based on uruntime's implementation" alone qualifies for a copyright review...

[probonopd]

uruntime is under the MIT License. Do you see any concerns with that @TheAssassin? We could always ask the author for explicit permission to apply this patch.

For me the question is also, are there any known real world use cases for which the added complexity from this code path is justified?