fix(spawn): map full id range for nested/in-pod builds so image-owned files copy up (#432)

[skeptomai]

Summary

Fixes #432. A nested pelagos build RUN step (uid 0 without CAP_SYS_ADMIN — a k8s pod, the #426 path) could not create files inside image directories owned by a non-root uid/gid. cargo build was the visible casualty:

error: failed to acquire package cache lock
  failed to open: /usr/local/cargo/.package-cache
  Value too large for defined data type (os error 75)   # EOVERFLOW

Root cause (isolated end-to-end on an ext4 node)

The nested user namespace mapped only 0→0. Container image layers own files as arbitrary ids — rust's /usr/local/cargo is gid 983. overlayfs copy-up must preserve that ownership onto the new upper file, but an id unmapped in the namespace cannot be represented, so any create beneath such a directory fails with EOVERFLOW.

Everything else was a red herring, including the issue's own framing:

• ❌ "package cache lock" — fails at openat, before any flock
• ❌ userxattr — the real mount doesn't even use it
• ❌ inode overflow / xino / cross-device — inodes ~10M, same device
• ❌ Rust / O_LARGEFILE — plain touch (glibc) fails identically
• ✅ unmapped uid/gid in the nested userns → copy-up EOVERFLOW

Fix

In the nested uid-0 case, identity-map the whole id space instead of 0→0. We still hold CAP_SETUID/CAP_SETGID there (only CAP_SYS_ADMIN was dropped), so the parent writes a multi-count map — the same mechanism already used for root-created user namespaces. Keeps in-pod builds fully rootless on native overlay (no privileged pod, no fuse-overlayfs perf hit). True rootless (uid ≠ 0) is unchanged (keeps subuid-range mapping). Both spawn and spawn_interactive map-setup sites updated.

Validation

• Gold-standard end-to-end: the real nested rust:1-bookworm + cargo build RUN step that failed with EOVERFLOW now completes and produces an image, rootless on ext4 (ipc4).
• Isolation proof: 0→0 map → CREATE-FAIL (EOVERFLOW); identity range map → CREATE-OK.
• New integration test test_nested_build_overlay_copyup_unmapped_gid (+ doc); cargo test --lib 392 passed; canonical cargo clippy -- -D warnings clean.
• Reproduction / root-cause / fix-proof scripts in scripts/repro-432-*.sh.

🤖 Generated with Claude Code