fix: harden native workspace root and docker gates

backend/test/fixtures/workspace-fs-at-race-worker.mjs

@@ -1 +1,5 @@
-process.stdout.write(JSON.stringify({ok:true}));
+import { createRequire } from "node:module"; import { resolve } from "node:path";
+const require = createRequire(import.meta.url); const a = require(resolve(process.cwd(), "native/workspace-fs-at/build/Release/workspace_fs_at.node"));
+let root = a.openat({parent:null,name:"/",kind:"directory",createMode:0}).handle; let successes=0, failures=0;
+for (let i=0;i<Number(process.env.ITERATIONS??100);i++) { try { const r=a.openat({parent:root,name:process.env.COMPONENT??"tmp",kind:"directory",createMode:0}); successes++; a.close(r.handle); } catch { failures++; } }
+a.close(root); process.stdout.write(JSON.stringify({ok:true,successes,failures}));

backend/test/fixtures/workspace-lock-root-worker.mjs

@@ -1 +1,14 @@
-process.stdout.write(JSON.stringify({ok:true}));
+import { createRequire } from "node:module";
+import { setTimeout as sleep } from "node:timers/promises";
+import { resolve } from "node:path";
+const require = createRequire(import.meta.url);
+const addon = require(resolve(process.cwd(), "native/workspace-fs-at/build/Release/workspace_fs_at.node"));
+const fsExt = require("fs-ext");
+let root = addon.openat({ parent: null, name: "/", kind: "directory", createMode: 0 }).handle;
+for (const p of (process.env.WORKSPACE_ROOT ?? "").split("/").filter(Boolean)) root = addon.openat({ parent: root, name: p, kind: "directory", createMode: 0 }).handle;
+const lockName = process.env.LOCK_NAME ?? "session-readers.lock";
+const lock = addon.openat({ parent: root, name: lockName, kind: "regular_lock", createMode: 0o600 }).handle;
+addon.withFd(lock, fd => fsExt.flockSync(fd, process.env.LOCK_MODE ?? "exnb"));
+process.stdout.write(JSON.stringify({ ready: true }));
+await sleep(Number(process.env.HOLD_MS ?? 100));
+addon.close(lock); addon.close(root);

backend/test/fixtures/workspace-registry-addressed-worker.mjs

@@ -1 +1 @@
-process.stdout.write(JSON.stringify({ok:true}));
+import { mkdir, writeFile } from "node:fs/promises"; const root=process.env.JOB_ROOT; if (!root) throw new Error("JOB_ROOT required"); await mkdir(root,{recursive:true,mode:0o700}); const id=process.env.RUN_ID??"a".repeat(32); await writeFile(`${root}/${id}.json`,JSON.stringify({runId:id,phase:"request_claimed"})+"\n",{flag:"wx",mode:0o600}); process.stdout.write(JSON.stringify({ok:true,runId:id}));

backend/test/fixtures/workspace-session-readers-worker.mjs

@@ -1 +1,14 @@
-process.stdout.write(JSON.stringify({ok:true}));
+import { createRequire } from "node:module";
+import { setTimeout as sleep } from "node:timers/promises";
+import { resolve } from "node:path";
+const require = createRequire(import.meta.url);
+const addon = require(resolve(process.cwd(), "native/workspace-fs-at/build/Release/workspace_fs_at.node"));
+const fsExt = require("fs-ext");
+let root = addon.openat({ parent: null, name: "/", kind: "directory", createMode: 0 }).handle;
+for (const p of (process.env.WORKSPACE_ROOT ?? "").split("/").filter(Boolean)) root = addon.openat({ parent: root, name: p, kind: "directory", createMode: 0 }).handle;
+const lockName = process.env.LOCK_NAME ?? "session-readers.lock";
+const lock = addon.openat({ parent: root, name: lockName, kind: "regular_lock", createMode: 0o600 }).handle;
+addon.withFd(lock, fd => fsExt.flockSync(fd, process.env.LOCK_MODE ?? "exnb"));
+process.stdout.write(JSON.stringify({ ready: true }));
+await sleep(Number(process.env.HOLD_MS ?? 100));
+addon.close(lock); addon.close(root);