fix(security): harden runtime against critical/high vulnerabilities

[miguelgila]

Summary

• Critical: Gate REAPER_NO_OVERLAY behind #[cfg(test)] — overlay bypass impossible in release builds
• Critical: Validate container/exec IDs against path traversal (../, empty, special chars)
• High: Restrict config file to REAPER_ prefixed keys only (prevents LD_PRELOAD/PATH injection)
• High: Set restrictive permissions (0700 dirs, 0600 files) on state files and directories
• High: Validate PID > 1 before sending kill signals in runtime and shim
• High: Always clear supplementary groups during privilege drop, even when additional_gids is empty

Test plan

• All 57 runtime unit tests pass (cargo test --bin reaper-runtime)
• Clippy clean (cargo clippy --all-targets)
• New unit tests for validate_id() (path traversal, empty, special chars, length)
• New unit test for config key rejection (non-REAPER_ keys)
• CI integration tests pass

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 87.80488% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.09%. Comparing base (c7ef98f) to head (8b16f66).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
src/bin/containerd-shim-reaper-v2/main.rs	72.72%	3 Missing ⚠️
src/bin/reaper-runtime/main.rs	50.00%	1 Missing ⚠️
src/bin/reaper-runtime/state.rs	96.15%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #25      +/-   ##
==========================================
+ Coverage   85.94%   88.09%   +2.14%     
==========================================
  Files           5        5              
  Lines         185      252      +67     
==========================================
+ Hits          159      222      +63     
- Misses         26       30       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.