fix(drop-sudo): preserve system service socket permissions and surface proxy errors

[Alphaxiaoteng]

Summary

1. Preserves permissions for system service IPC sockets (such as /run/dbus/system_bus_socket and /run/systemd/*) during the drop-sudo privilege drop process, preventing systemd-resolved and other core system peers from entering permission-denied crash loops on GitHub-hosted and Linux runners.
2. Surfaces Responses API proxy startup stderr when the proxy fails to write its server info file (e.g. invalid endpoint / key format / network failure) so errors are immediately visible in Actions logs instead of being swallowed.

Fixes #160 and resolves the failure misreporting in #127.

---

Root Cause

1. D-Bus & systemd socket mode truncation (#160)

Under safety-strategy: drop-sudo, restrictRootServiceSocket previously stripped all group and other permission bits (fs.chmod(fd, stats.mode & 0o700)) on every discovered root-owned socket under /run.

On Ubuntu / Debian systems:

• systemd-resolved runs as the non-root systemd-resolve user and relies on connecting to /run/dbus/system_bus_socket and /run/systemd/journal/stdout.
• Applying 0o700 removes group/world readability and writability, immediately denying non-root system daemons access to the system bus.
• Upon any internal service restart, systemd-resolved fails to connect to D-Bus and crash-loops, permanently destroying local DNS name resolution across the entire runner machine.
• On GitHub-hosted runners, this causes jobs running past ~50 minutes to terminate with "lost communication with the server" as background runner agent credentials fail to refresh over DNS.

2. Swallowed proxy startup diagnostics (#127)

When codex-responses-api-proxy is spawned in the background, stdout/stderr were previously discarded. If the proxy exited due to misconfiguration or key format refusal, the action failed only with the generic responses-api-proxy did not write server info after a 10s timeout, hiding the real root cause from the user.

---

Changes

1. System Service Socket Whitelist Protection: Added PRESERVED_SYSTEM_SOCKET_PREFIXES in src/dropSudo.ts to safeguard /run/dbus/, /run/systemd/, /var/run/dbus/, and /var/run/systemd/ from mode truncation during restrictRootServiceSocket().
2. Verification Exemption: Exempts preserved system sockets from the post-drop access verification step so valid shared system sockets don't trigger false-positive assertion failures.
3. Proxy Error Diagnostics: Redirected proxy output to a runner log file and piped the log to stderr if server-info creation fails.
4. Unit & Regression Testing: Added test/preservedSystemSockets.test.mjs verifying that system sockets remain preserved with 0666 while general daemon sockets (e.g. docker.sock) remain properly restricted to 0700.

---

Verification

• npm run build completed cleanly (esbuild bundle updated).
• npm test passed: 145/145 tests passing (0 failures, 3 skipped Windows-specific isolation tests).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Alphaxiaoteng]

I have read the CLA Document and I hereby sign the CLA

[Alphaxiaoteng]

recheck