Test grader changes the way production launches tests

Before trusting test-harness changes, read how the production runner actually launches each test, and reproduce it locally. In this case every local run used python3 -m grader as root in a container. The real runner unshares new namespaces per test, demotes to uid 65534 (nobody) in preexec_fn, and uses a tempfile scratch dir in the container's /tmp (overlayfs). Things that silently change as non-root: cgroup v2 writes, so pids caps fall back or fail; mount --bind fails (setuid fusermount3 still works with user_allow_other); writes to bind-mounted host dirs may fail. Fix it root-side, before the demotion: delegate a cgroup subtree by chowning the dir, cgroup.procs and subtree_control to the uid and moving the child in before setuid; create the scratch dir on real disk and chown it. Then test the full image path with the production docker flags.