Fix release preflight runner capabilities

[cbusillo]

Objective

Make the release preflight cargo nextest run --no-fail-fast --locked job pass on the Linux preflight runner without weakening release coverage.

Current Status

State: Blocked
Next action: Decide whether to configure the self-hosted preflight runner with the missing capabilities, or split environment-specific tests onto runners that actually support them.
Blocked by: Release preflight runner/test environment mismatches.
Last verified: 2026-05-24 in Release run 26353066927 after PR #107 merged.

Evidence

Release run 26353066927 reached full preflight nextest and ran 1707 tests: 1700 passed, 7 failed, 4 skipped. All release build matrix jobs succeeded, including both musl targets.

Failing preflight tests:

• code-browser::local_navigation internal_browser_can_open_local_http_server
• code-core agent_tool::tests::read_only_agents_redirect_stdin_away_from_parent_pipe
• code-app-server::binary_smoke binary_smoke_requires_init_and_executes_command
• code-linux-sandbox::suite::landlock::test_dev_null_write
• code-linux-sandbox::suite::landlock::test_root_read
• code-linux-sandbox::suite::landlock::test_timeout
• code-linux-sandbox::suite::landlock::test_writable_root

Earlier release setup blockers have already been fixed by PRs #103-#107: npm auth no longer blocks validation-only runs, release toolchain state is workspace-local, the workflow no longer assumes Python setup on self-hosted runners, and x86 musl builds now run on hosted Ubuntu.

Finish Line

A main-branch Release run completes with the preflight job green and release build jobs green.

Acceptance Criteria

• Browser-dependent tests have a detectable Chrome/Chromium executable or are assigned to a runner that provides one.
• Landlock sandbox tests run only where the required Linux kernel/sandbox capabilities are available, or the preflight runner is configured to provide them.
• Agent stdin detachment and app-server smoke failures are either fixed as product/test bugs or routed to the correct execution environment.
• The release workflow remains a meaningful full preflight, not a blanket skip of failing coverage.

Relationships

Blocks #87.
Related release verification run: https://github.com/cbusillo/code/actions/runs/26353066927

Notes

The x86 musl hosted-runner issue was resolved by PR #107; the remaining release blocker is now isolated to preflight nextest on the Linux self-hosted runner.