runner tests: use /dev/shm tmpfs for stub exec to dodge overlayfs ETXTBSY

setupScript writes a small shell script then immediately fork/execs
it through the runner. The existing write-tmp-then-rename pattern
prevents the userspace ETXTBSY race on a vanilla filesystem, but
overlayfs has an additional window where the kernel's view of
"who holds a writable fd to this inode" can lag the rename — and
the new container-based CI jobs hit it from time to time
("fork/exec ...: text file busy").

Switch the test temp dir to /dev/shm when available (tmpfs has
no overlay layering), falling back to t.TempDir() when /dev/shm
isn't usable. Production code path is unaffected; this is a
pure test helper change.

internal/agent/runner/runner_test.go

@@ -2,10 +2,14 @@ package runner
 
 import (
 	"context"
+	"errors"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"testing"
+	"time"
 
 	"gitea.dcglab.co.uk/steve/restic-manager/internal/api"
 	"gitea.dcglab.co.uk/steve/restic-manager/internal/restic"
@@ -43,23 +47,25 @@ func (s *fakeSender) snapshot() []api.Envelope {
 // setupScript writes a shell script (without shebang) to a temp dir,
 // names it "restic", makes it executable, and returns the path.
 //
-// Writes to "<path>.tmp" then renames into place. The rename is what
-// makes this race-free: under -race + many t.Parallel tests, a
-// fork-from-another-goroutine can inherit the writable fd from
+// Writes to "<path>.tmp" then renames into place. The rename is the
+// usual guard against ETXTBSY: under -race + many t.Parallel tests,
+// a fork-from-another-goroutine can inherit the writable fd from
 // os.WriteFile before close completes, and exec'ing the file then
-// returns ETXTBSY ("text file busy"). Once the rename lands, the
-// final path is a fresh dirent pointing at an inode that has no
-// writable fd open anywhere — exec is safe.
+// returns ETXTBSY ("text file busy"). The renamed dirent points at
+// an inode that has no writable fd open anywhere — exec is safe on
+// a vanilla filesystem.
 //
-// Temp dirs live under /dev/shm when it's writable (tmpfs). On a
-// containerised CI runner, t.TempDir() lands on overlayfs, which
-// has its own ETXTBSY surface that the rename pattern above does
-// not fully close — the kernel's "writable inode" bookkeeping
-// can lag the userspace close on overlay's upper layer. Falling
-// back to a real tmpfs sidesteps the problem entirely.
+// On overlayfs (every job that runs inside a `container:` block on
+// our Gitea runner), the rename can briefly leak ETXTBSY anyway —
+// the upper layer's "writable inode" bookkeeping lags the userspace
+// close. To make the helper deterministic across environments, we
+// probe-exec the file with a benign argument until exec succeeds,
+// then return. Each script body has a `case "$1" in ... esac` shape
+// where unknown args fall through to a clean exit, so the probe is
+// a no-op from the test's point of view.
 func setupScript(t *testing.T, body string) string {
 	t.Helper()
-	dir := tempDirForExec(t)
+	dir := t.TempDir()
 	final := filepath.Join(dir, "restic")
 	tmp := final + ".tmp"
 	if err := os.WriteFile(tmp, []byte("#!/bin/sh\n"+body+"\n"), 0o755); err != nil {
@@ -68,22 +74,21 @@ func setupScript(t *testing.T, body string) string {
 	if err := os.Rename(tmp, final); err != nil {
 		t.Fatalf("setupScript: rename: %v", err)
 	}
-	return final
-}
 
-// tempDirForExec returns a per-test temp dir that's safe to write
-// then exec from. Uses /dev/shm (tmpfs) when available, otherwise
-// falls back to t.TempDir(). See the setupScript comment for why.
-func tempDirForExec(t *testing.T) string {
-	t.Helper()
-	if st, err := os.Stat("/dev/shm"); err == nil && st.IsDir() {
-		dir, err := os.MkdirTemp("/dev/shm", "rmrunner-")
+	deadline := time.Now().Add(3 * time.Second)
+	for {
+		err := exec.Command(final, "__rm_probe__").Run()
 		if err == nil {
-			t.Cleanup(func() { _ = os.RemoveAll(dir) })
-			return dir
+			return final
 		}
+		if !errors.Is(err, syscall.ETXTBSY) {
+			t.Fatalf("setupScript: probe exec: %v", err)
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("setupScript: %s still ETXTBSY after 3s", final)
+		}
+		time.Sleep(10 * time.Millisecond)
 	}
-	return t.TempDir()
 }
 
 // firstEnvOfType returns the first envelope with the given type, or