Runner: start examples with requested user and group IDs

[brandonpayton]

What this does

#907 already landed the current PHP/runtime stack, including the mmap and munmap work that overlapped the old composite #769 branch. It did not connect the example runner to the initial credential support that already exists in the Node and browser hosts.

This PR keeps that one remaining piece. run-example.ts now reads KERNEL_UID and KERNEL_GID, validates them as decimal guest IDs, and passes them to the normal host spawn path. A small guest probe checks the real and effective user and group IDs reported by the kernel.

The host protocol uses 4294967295 as “leave this credential unchanged,” so the runner rejects that value instead of silently starting the guest as root. 4294967294 remains a valid ID.

Source: extracted from #769 commit 6d16dd548fe802eb5befce9895a188bdb0b9a8f7 onto current main.

What was deliberately removed

• No mmap or munmap changes; Batch PHP support and bundle ABI updates with their runtime changes #907 already landed that work.
• No SQLite harness, patch, timeout, or package changes from the old Fix mmap accounting under partial munmap churn #769 stack.
• No kernel, syscall, browser runtime, or credential-policy changes.
• No replay of the stale parser that accepted the host protocol's reserved sentinel.

ABI and package impact

There is no ABI change. The existing host/kernel credential API and ABI 39 stay unchanged, and scripts/check-abi-version.sh reports the snapshot and generated bindings are current.

There is no package-artifact change and no package revision bump. The added Wasm file is a test fixture built locally from source; it is not committed or published as a package output.

Validation

Passed through scripts/dev-shell.sh on implementation head 7189b84985a837783c02e837b15b8c9f4ef9017c:

• bash build.sh
• focused credential regression: 9/9
• CI-shaped Vitest: 1,275 passed, 2 expected failures, 130 skipped
• Node/Bun teardown follow-up: 3/3
• kernel unit tests: 1,151/1,151
• host declaration typecheck
• ABI snapshot/version check
• git diff --check

The first Linux CI Vitest run exposed that the new regression inherited the checkout's host ownership and group modes. The guest only needs to inspect its credentials, so the final test starts it in world-traversable /tmp and reports child stderr on failure. The focused credential regression passed 9/9 through scripts/dev-shell.sh on final head 471dc2335abe77c2c696f7bfc1d0cce529710ad7; the full CI rerun is in progress.

Not run locally on the final test-only head: the full Vitest matrix, browser Playwright or manual browser checks, libc/POSIX/Sortix conformance, package builds, or performance benchmarks. This is Node-only example-runner wiring over an existing cross-host spawn contract; it does not change kernel or browser behavior. No performance claim is made.

[brandonpayton]

Closing this focused source PR because its requested initial credential behavior is now carried by #934 at exact green head 260d75d5adc31b327f5591229dbfbb287d395fd6. #934 folds this PR’s small test correction into the credential-purpose commit instead of preserving it as a separate fixup. The full staging gates passed. This is not a claim that this branch was merged verbatim.