Harden signal safety and fix SIGSYS leak to guest

[jserv]

The supervisor's SIGSYS handler runs with SIGSYS blocked (SA_SIGINFO default). emulate_trap_rt_sigprocmask was writing the raw uc_sigmask, including that SIGSYS bit, back to the guest's old_ptr, leaking the reserved signal into the guest's visible signal state. Same leak existed in emulate_trap_rt_sigpending.

This fixes both by stripping the reserved SIGSYS bit before writing to guest memory. Extract kbox_syscall_trap_sigset_strip_reserved() as the inverse of the existing kbox_syscall_trap_sigset_blocks_reserved().

Add signal safety contract documentation to procmem.c, syscall-trap.c, and seccomp-dispatch.c enumerating every signal-visible global, its protection invariant, and what breaks if multi-threaded guests are introduced.

Change-Id: I67ff940a7b079990fca088ecc46a78c01162a5c1

---

Summary by cubic

Fixes SIGSYS leaking into the guest and hardens signal safety across trap/dispatch. We strip SIGSYS from emulated rt_sigprocmask/rt_sigpending, keep other signals (e.g., SIGURG) transparent, and add tests for delivery and fault recovery.

• Bug Fixes

  • Strip reserved SIGSYS from emulated rt_sigprocmask (old mask) and rt_sigpending.
  • Zero-init temporary sigset buffers in rt_sigprocmask to avoid garbage bytes.
  • On rt_sigaction(SIGSEGV/SIGBUS), bump a generation counter so procmem reinstalls its fault handler; all other signals pass through (incl. SIGURG).

• Refactors

  • Added kbox_syscall_trap_sigset_strip_reserved() and documented signal-safety/single-thread invariants in procmem.c, syscall-trap.c, and seccomp-dispatch.c.
  • Tests: new guest signal-safety-test (SIGURG passthrough, SIGSEGV guard-page recovery, SIGSYS invisibility), signal-test updates, and procmem fault-recovery units; test runner runs the new test; export KBOX_SYSCALL_MODE to the guest environment.

^{Written for commit 0000091. Summary will update on new commits.}