fix: say why a sandbox failed to launch, and observe a run instead of an instant

The cgroup test read the live process tree with one `ps` per pid and asserted
while the provider was running. That was a race it used to win only because the
sandbox was slow; now a whole run finishes in a few hundred milliseconds and
`systemctl show` alone costs longer than the thing it describes. It records the
tree from `/proc` every 5ms and asserts on the recording once the run is over,
because the assertions were always about what the run contained.

That restructuring immediately paid for itself: the supervisor had been failing
to launch the sandbox at all, and the test was dying on the observation before
it ever checked the exit code.

It could not say why, because the supervisor consumed the child's output solely
to enforce a byte cap and then discarded it — `exit=1` and nothing else. It now
keeps the lines the sandbox tooling itself emits (`bwrap:`, `prlimit:`,
`systemd-run:`, `systemctl:`), which cannot carry provider credentials because
the provider command and its secrets travel in the args file. The failure now
reads:

  sandboxed external provider failed: exit=1; sandbox reported:
  bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

which is a host restriction — `kernel.apparmor_restrict_unprivileged_userns=1`
— reproducible in two lines of shell containing none of this repository's code,
and recorded in the ledger as such rather than carried as a product defect.

Suites that spawn processes, build archives and sign evidence were given a 30s
budget. The 10s default is sized for pure-JS unit tests; raising it globally
would hide a genuinely hung test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/risk-coverage.test.ts

@@ -24,6 +24,14 @@ import {
   type ProductionModuleInventory,
 } from "../../scripts/lib/risk-coverage.ts";
 
+/**
+ * This suite's budget, not the file's. The 10s default is sized for pure-JS
+ * unit tests; these spawn processes, build archives and sign evidence, and on a
+ * machine running the rest of the suite in parallel they legitimately need
+ * longer. Raising the global default instead would hide a genuinely hung test.
+ */
+const PROCESS_HEAVY_TIMEOUT_MS = 30_000;
+
 const roots: string[] = [];
 const now = Date.parse("2026-08-02T00:00:00.000Z");
 const execFileAsync = promisify(execFile);
@@ -141,7 +149,7 @@ describe("repository-aware risk coverage", () => {
       result.repositoryTotal - result.selectedTotal,
     );
     expect(result.status).toBe("FAIL");
-  });
+  }, PROCESS_HEAVY_TIMEOUT_MS);
 
   it("reports exact inventory and generated-exclusion provenance", async () => {
     const repositoryRoot = await repositoryFixture();