Fix native MariaDB FUSE ownership readiness

[chubes4]

Summary

• Run MariaDB initialization and daemon as the verified unprivileged caller that owns the private FUSE filesystem.
• Replace the marker-only native descriptor probe with a disposable full provision/readiness/release lifecycle.
• Cover caller ownership and full readiness semantics in the deterministic native service suite.

Security Compatibility

The existing UID-0 rejection, trusted binary resolution, private-path containment, 256 MiB/4,096-inode filesystem geometry, fixed rlimits, loopback-only access, and verified process-group/root cleanup are unchanged. Descriptor discovery fails closed if this full lifecycle cannot be proven.

Verification

• npm run build
• npm run test:runtime-services
• Lab candidate /home/chubes/Developer/wp-codebox-2238.RNt9aH, Node v24.18.0, PATH prefixed with /home/chubes/.local/opt/node/bin, and a fresh /home/chubes/Developer/.tmp/wp-codebox-2238-final.*: build and test:runtime-services passed.
• npm run test:native-mariadb-runtime-service-integration ran against MariaDB 11.8.6 and fuse2fs 1.47.2, returning the intended fail-closed bounded-filesystem-unavailable result. Lab kernel audit proves the remaining block is an enforced AppArmor mariadbd profile denial of mknod in the private FUSE path with both fsuid=1000 and ouid=1000; it is not a Unix/FUSE ownership failure. This change correctly prevents a false-ready descriptor in that environment without bypassing the host MAC policy.

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode inspected the runtime-service lifecycle, implemented the caller-ownership and readiness changes, and ran the documented local and Lab verification. Chris Huber remains responsible for every line.