fix(security): deny raw factotum grants

[pdfinn]

Summary

• Reject caller-supplied /mnt/factotum path grants in nsconstruct, tools9p, and nsaudit.
• Preserve the existing trusted namespace-construction path that grants factotum only to fixed credential-using tools without exec/shell.
• Add regression coverage for live bindpath, startup -p, nsaudit rule corpus, namespace manifest invariants, and direct nsconstruct policy.

Security rationale

Factotum is the credential boundary. It is intentionally auto-mounted only for selected fixed-function tools and withheld when arbitrary exec/shell is present. A raw /mnt/factotum path grant bypasses that mediation and can hand the credential service to arbitrary tools, so it should be treated as a privileged control-capability root rather than a generic filesystem path.

Tests

• tests/host/namespace_path_policy_test.sh
• tests/host/namespace_manifest_invariants_test.sh
• tests/host/nsaudit_rules_test.sh
• tests/host/tools9p_integration_test.sh
• git diff --check