fix(rootfs/qemu-static): killswitch builder anchors emulation lock; native builder probes EX-NB before disabling qemu-arm

K-builder (NATIVE_ARMHF_ON_ARM64=no) now takes a SH-lock on
/proc/sys/fs/binfmt_misc/qemu-arm for its lifetime instead of returning
immediately. N-builder (default) probes EX-NB on a fresh fd before
acquiring its own SH; if probe fails AND qemu-arm is observably enabled
(state==1), a K-builder holds the emulation anchor and switching to
native mid-flight would corrupt their qemu-arm-static routing — refuse
with exit_with_error.

Symmetric closure of the K↔N race:
- N→K: K sees qemu-arm=0 → fail-fast via the existing prepare_host
  guard (addressed in 9d8b848).
- K→N: N sees EX-NB fail + state=1 → fail-fast with 'concurrent build
  with NATIVE_ARMHF_ON_ARM64=no holds emulation lock' (this commit).

Verified end-to-end on Hetzner CAX21 (4-core Ampere Altra, Ubuntu 6.8):
- N first, K second: K exits 8s with 'qemu-arm globally disabled by
  another concurrent build'.
- K first, N second: N exits 12s with 'cannot enable native armhf:
  concurrent build with NATIVE_ARMHF_ON_ARM64=no holds emulation lock'.
- Cleanup of both K (release SH) and N (last-out restore echo 1) leaves
  qemu-arm in 'enabled' state.

Assisted-by: Claude:claude-opus-4.7

Author: iav

lib/functions/logging/traps.sh

@@ -140,6 +140,25 @@ function add_cleanup_handler() {
 	trap_manager_cleanup_handlers=("${callback}" "${trap_manager_cleanup_handlers[@]}")
 }
 
+# Like add_cleanup_handler but appends to the tail of the list, so the
+# registered callback runs AFTER everything added with add_cleanup_handler
+# at the time run_cleanup_handlers fires. Use this when a handler needs to
+# observe a fully-torn-down state — e.g. it can't safely re-mutate a
+# kernel-global resource while subshells of the build are still alive and
+# may have inherited the resource's fd.
+function add_cleanup_handler_last() {
+	if [[ $# -gt 1 ]]; then
+		exit_with_error "add_cleanup_handler_last: too many params"
+	fi
+	local callback="$1"
+	if [[ -z "${callback}" ]]; then
+		exit_with_error "add_cleanup_handler_last: no callback specified"
+	fi
+
+	display_alert "Add callback as last cleanup handler" "${callback}" "cleanup"
+	trap_manager_cleanup_handlers+=("${callback}")
+}
+
 function execute_and_remove_cleanup_handler() {
 	local callback="$1"
 	display_alert "Execute and remove cleanup handler" "${callback}" "cleanup"