fix(setup): release owned temporary runtime before exec

[LucaLin233]

Summary

Successful exec bypasses EXIT cleanup. Both cached and temporary-fallback self-update leaked the old runtime. Pin the validated script inode with an inherited read FD, remove the recorded owned runtime before exec, and run Bash through /proc/self/fd. Refuse handoff on cleanup/ownership failure. Mandatory bootstrap now returns immediately on failed handoff. Add conventional HUP handling; keep abnormal-exit diagnostic retention.

Scope

Base 4375776; HEAD ed918a1; branch luno/fix-setup-exec-temp-lifecycle. Four files, +236/-12: linux_setup.sh, tests/test-setup-exec.sh, tests/run.sh, tests/test-selection.sh. No module failure policy, cache digest algorithm or production system changes.

Validation

https://github.com/LucaLin233/Linux/actions/runs/34257631313 passed both required environments, full=true, all 12 suites each. Dedicated tests passed cached/fallback real exec, cleanup failure, replaced/symlink directory refusal, exec failure status 127, HUP/INT/TERM 129/130/143, actual main/self_update cache/download paths, fixed-version update consent/refusal, and old-exec leak counterexample. Replacement sentinel survives. Existing cache tamper/mode/symlink and RUN_COMMIT tests remain passing.
Main after #47 independently passed both 11-suite full runs: 34255755951.
Local changed-file bash -n, git diff --check and remote/local byte comparison passed. No host behavioral tests. Earlier CI identified SC2093; narrowly documented execfail continuation rather than removing real exec or suppressing globally. New commits superseded older CI through existing concurrency, not manual retry-to-green.

Self-review and risks

Complete base-relative diff reviewed again. Successful handoff removes the old runtime; replacement receives an open script FD, not path-based cleanup authority. Cached SHA-256 is rechecked. Failed mandatory handoff does not fall through to another prompt. Cleanup failure remains nonzero.
Linux /proc FD paths required. An inherited read-only script FD persists until process exit and may be inherited by descendants; the unlinked inode is released when all such descriptors close. Tests use inert replacement scripts and stub network/system boundaries, not a real deployment. Signals are tested before handoff, not exhaustively at every instruction. Directory identity validation assumes normal sticky /tmp and private mode 0700; it does not defend against hostile same-UID/root concurrent mutation. FD pinning is not immutable-byte protection from that owner. Nonzero exits retain diagnostic directories intentionally.
Deferred batch anomaly remains issue #53, not fixed by this PR. Same-assistant second review, not independent third-party review.

Rollback and authorization

Recommend merge for this bounded lifecycle scope, with these limits explicit. Revert eventual squash commit through a separate PR. No deployment/data rollback needed. Draft remains pending explicit merge confirmation; no merge performed. Project 4 and historical audit remain pending.