fix(fspy): run processes untracked when injection fails

[lifeiscontent]

Motivation

Fixes #700.

Cached tasks run under fspy file tracking, which injects a preload library into every spawned process. For statically linked binaries the preload installs a seccomp user-notification filter before exec. In sandboxes that deny the seccomp syscall (rootless bubblewrap under a restrictive outer profile, some CI environments) that install fails with EPERM, and the interposed exec returned the error instead of running the program — every spawn in a cached task failed before the child ran.

Two adjacent failure modes had the same shape: the preload constructor aborted the host process when FSPY_PAYLOAD was missing or malformed (e.g. a leaked LD_PRELOAD in an env-scrubbed sandbox), and vt panicked when the preload library could not be written to the temp dir.

Tracking is observability; it must never break the process being traced.

Changes

• exec/posix_spawn hooks: when the injection machinery fails, the run's trace is marked incomplete and the operation is executed untracked with the original arguments. Authentic exec failures (missing program, permissions) keep their original errno.
• New Sender::report_loss on the shm channel sets the CLOSED gate, so a run with an escaped process is treated as untracked and never cached from a partial trace.
• The preload constructor and channel attach no longer panic; the process runs untracked instead.
• vt falls back to a plain untracked spawn when the tracked spawn itself fails, reported as "Not cached: file access tracking failed to start" rather than failing the task.

Affected tasks run normally but are not cached; declaring explicit input/output (without auto) restores caching in such environments.