fix(execd): init-mode signal forwarding + execd-init e2e coverage (OSEP-0018)

[Pangjiping]

Summary

Phase-1 (OSEP-0018) e2e coverage plus one real fix the new tests exposed.

1. Bug fix: in-namespace application signals leaked into /command

In init mode, runCommand/runBackgroundCommand still subscribed
forwardSignals and forwarded HUP/USR1/USR2/WINCH to the running /command
process group, stacking with forwardInitSignals. An in-namespace
kill -HUP 1 therefore leaked the signal into whatever /command was running
and killed it (signal: hangup).

Fix: skip the subscription when init mode is active (initModeActive());
signals are owned by forwardInitSignals (forwarded to the entrypoint group,
SIGTERM triggers the shutdown sequence). Classic mode unchanged.

2. execd-init e2e additions (tests/python/tests/test_execd_init_e2e.py)

• test_application_signal_forwarded_to_entrypoint — HUP reaches the
  entrypoint (reproduces the bug above; fails on old code)
• test_entrypoint_exit_code_propagates — exit 42 observed on the docker
  bridge status (exited with code 42); k8s asserts state only
• test_in_namespace_sigterm_kill1_stops_sandbox — interim-behavior pin
  (OSEP-0018 §3, R-a): in-namespace kill 1 still stops the sandbox; comment
  marks it to flip once the trusted out-of-band stop channel lands
• test_fork_heavy_keeps_process_table_bounded — 20 fork-churn rounds, no
  zombies, bounded process count
• test_hardening_reports_pid1 extended to assert signal_shield: true

3. chore: drop committed vmlinux BTF dump headers (-353k lines)

vmlinux_6_14_0*.h are kernel BTF dumps needed only at bpf2go generation
time; the generated bytecode is already embedded in the audit_bpf*.go
bindings, so builds/tests/execd-ebpf never touch them. Removed, gitignored,
regeneration documented in audit.bpf.c.

Verification

• Local docker-bridge run of the full suite: 10 passed
• go build ./..., go vet, CGO_ENABLED=1 go test -tags ebpf ./pkg/ebpf/,
  go test ./pkg/runtime/ all green
• TestMergedView failures in pkg/isolation are pre-existing (verified by
  stashing this branch's changes) and unrelated
• ruff + pyright clean on the test file

Out of scope

• External SIGTERM graceful-shutdown e2e (server kill is SIGKILL+remove; unit
  tests cover terminateInit)
• Hardening/Landlock/eBPF e2e (Phases 2–4, separate enablement)

[Pangjiping]

Superseded by opensandbox-group#1546