T-8292 [Fable] Atomic unix socket takeover + inode-guarded cleanup

[alistairjevans]

Problem

After a complete docker shutdown/restart, unix sockets sometimes never recover.

Root cause is a cross-generation race in this gem's socket lifecycle:

1. start() did exists → remove_file → bind, silently stealing the path from a still-running older server, with a window where the path doesn't exist at all.
2. stop() unconditionally unlinked the bind path by name, with no check that the file was still the socket this server bound.

On a normal rolling deploy (swarm stop-first) generations never overlap, so this never bit. After a full docker restart, swarm reconciliation can start the new task while the old container is still draining (5s DRAIN_TIME): the new server binds the socket, then the old server's stop() deletes the new server's socket file. The new server keeps listening on an unlinked inode forever — haproxy gets ENOENT on every connect and nothing ever recreates the file, until the replica is manually restarted.

The ticket's WARN Failed to remove socket file: NotFound log line is that manual restart: the victim discovering at shutdown that its socket file had been missing for its whole run. The harmful deletion itself was silent.

Fix

• start(): bind to a unique temp path ({path}.{pid}.{seq}.tmp) and atomically rename(2) it over the target. The path always points at a live socket, and takeover of a still-bound path is a single step.
• stop(): record the bound socket file's (dev, ino) at bind time (lstat'd on the temp path, so it can't race) and only unlink the path if it still matches. An older generation can no longer remove a newer generation's socket; if the path was taken over it's left in place with an info log.

Error-message change: startup failures at the target path now raise Failed to install Unix socket file … (rename step) instead of Failed to remove existing Unix socket file ….

Tests

• test_unix_socket_takeover_preserves_new_generation_socket — old server stops while a new server owns the path: socket file survives, is connectable, and the new server's own stop still cleans it up. Reproduces the production race (and the ticket's NotFound warning) on unfixed code.
• test_unix_socket_stop_leaves_foreign_file — stop leaves a file it didn't bind untouched.
• Updated the undeletable-file/directory error tests for the new failure point.

Full suite: 39 runs, 0 failures (1 skip = sudo-gated test).