x86 gate wrapper is untracked and never repacks the userspace test disk (can boot stale binaries)

[ryanbreen]

Summary

The x86 build+boot gate that actually runs on the beast VM, /root/run-x86-gate.sh, is not in the repository. It is a hand-maintained script on the breenix-x86 Incus VM, so every hardening applied to it (and every fix it needs) is one re-provision away from being lost. Two things it currently gets wrong or carries only as a local edit:

1. It never repacks the userspace test disk. It runs ./userspace/programs/build.sh to rebuild the ELFs, but target/test_binaries.img is only packed by cargo run -p xtask -- create-test-disk, which it never calls. Both the ELFs and the image are gitignored build outputs, so a gate run on a branch touching userspace/ or libs/libbreenix-libc can boot the previous branch's binaries and report green.

   This was hit for real while building the x86 TCP-recv blocked thread never rescheduled → boot-test hang (pre-existing) #545 PR-A expected-red proof: a test program was rebuilt with an injected fault, and the kernel logged Loaded 'brk_test' from test disk (182448 bytes) while the rebuilt ELF on disk was 182496 bytes. The in-repo equivalent of this bug was fixed in docker/qemu/run-x86-boot-tests.sh (branch fix/x86-test-gate-honesty), which now removes and repacks the image every run; the beast wrapper needs:

   rm -f target/test_binaries.img
   cargo run -p xtask -- create-test-disk

   right after the userspace ELF build.

2. Its honesty fix lives only on the VM. In full mode it now calls scripts/x86-gate-verdict.sh instead of grepping for a liveness marker, and (as of x86 TCP-recv blocked thread never rescheduled → boot-test hang (pre-existing) #545 PR-A round 2) passes the newly mandatory EXPECTED_EXITS=10. Both edits exist only as in-place changes on the VM, with a .bak-pra alongside. Re-provisioning restores marker-grep blindness.

Suggested shape

Move the wrapper into the repo (e.g. docker/qemu/run-x86-gate.sh or scripts/ci/) with the VM-specific bits — KVM accel env vars, the rust-fork symlink repoint — behind env vars or flags, so the gate that guards merges is versioned with the code it guards. This is review note N1 from the #545 PR-A round-1 review.