Add working-directory and environment controls for child processes

[mjrusso]

Summary

This PR adds two child-process options:

• cwd: selects the working directory
• env: accepts an overlay or a complete replacement environment

This PR also fixes shepherd startup failure handling. If the operating system rejects the shepherd’s arguments or environment, NetRunner now reports the failure promptly instead of waiting for the Unix-socket timeout.

Note that the first commit documents existing MSG_ERROR behaviour; it does not change the wire format.

Spawn sequence

BEAM
  validate cwd and env
  create the Unix-socket listener
  start the shepherd with the requested environment changes
  wait for either:
    ├─ an authenticated connection
    └─ shepherd exit → {:shepherd_spawn_failed, reason}

shepherd, after authentication
  chdir(cwd), when present
  filter inherited variables, in replacement mode
  fork
  exec the child

Waiting for socket readiness and shepherd exit in the same receive loop avoids the previous 10-second timeout when the shepherd could not start. An immediate child exit after a successful spawn remains a normal process result.

Temporary socket paths are removed after successful and failed spawns.

Working directory

cwd: is available through run/2, stream/2, stream!/2, and NetRunner.Process.start/3. NetRunner.Daemon accepts it through process_opts.

The value must be a non-empty binary without NUL. It does not need to contain valid UTF-8, which permits valid filesystem paths with arbitrary bytes.

The shepherd calls chdir after authentication and before fork. This means:

• Relative child paths and executable names resolve from cwd.
• A relative cwd: resolves from the BEAM working directory.
• A failed chdir returns {:error, {:shepherd_error, reason}} before a child starts.
• PWD is not updated automatically.

Environment

env: accepts a map or a list of {name, value} pairs.

Form	Inherited variables	Command lookup
env: environment	Retained unless overridden or removed	Uses the resulting PATH
env: {:replace, environment}	All unselected variables are removed	Uses only the selected PATH

A binary value sets a variable. nil and "" remove it. If a list contains the same name more than once, the last value wins.

Names must be non-empty UTF-8 binaries without = or NUL. Values must be UTF-8 binaries without NUL, or nil. Invalid input raises ArgumentError before NetRunner starts the shepherd.

In replacement mode, omitting PATH disables the default execvp search path. A command containing / is still attempted directly.

Environment transport

Values pass through the Port.open/2 environment option and do not appear in the shepherd command line. They remain visible through normal process-environment inspection.

Replacement mode passes the names of retained variables, but not their values, in the shepherd argument allowlist. Those names count toward both the operating system’s argument and environment size limits.

If the operating system rejects the shepherd because its arguments or environment are too large, NetRunner returns:

{:error, {:shepherd_spawn_failed, reason}}