test: expose runner dependency and validation regressions

[MuncleUscles]

Summary

Adds failing regression coverage for eighteen runner dependency, validation, and precompile-cache issues.

This PR is intentionally test-only. It is stacked on #16 and does not change production behavior.

Regressions captured

• a root runner that declares Depends: contract is processed again because the root is not initially present in the dependency visited set; the integration fixture observes an unexpected second, cached load of the same root runner
• RegisterRunner returns a custom: ID and pins a runner whose runner.json action cannot be deserialized, deferring the malformed-runner error until later use
• RegisterRunner accepts and pins a runner that explicitly declares a GenVM major incompatible with the current executor
• SetArgs accepts an embedded NUL and serializes an argument whose WASI buffer terminates before the complete runner-supplied value
• AddEnv accepts names containing = or NUL and values containing NUL, producing ambiguous or prematurely terminated WASI environment entries
• MapFile accepts an empty destination and creates an unreachable empty-name VFS entry
• a MapFile destination such as /./vm/secret passes the protected /vm guard even though it normalizes into that tree
• mapping a nonexistent archive directory silently succeeds as an empty no-op, unlike mapping a nonexistent single file
• the USTAR parser accepts a truncated archive with both required zero end markers removed
• a fixed-width USTAR name keeps bytes after its first NUL, exposing file\0ignored instead of the standard name file
• the ZIP parser accepts a Stored entry whose central-directory compressed and uncompressed sizes disagree
• a Deflated ZIP local entry can bypass the Stored-only policy when its central-directory compression method claims Stored
• genvm check panics on a registry runner hash shorter than two characters instead of returning an installation error
• genvm check accepts a registry runner name such as ../outside, allowing artifact validation outside the configured runners directory
• a failed recompile leaves the previous native module loadable under the same cache key, so cached loading accepts a module whose current Wasm source fails cold compilation
• a successful precompile pass silently keeps the old native modules when an entry with the same path is no longer Wasm
• recompilation truncates and rewrites the same cache-file inode that a live Wasmtime module may still have memory-mapped, violating Wasmtime's deserialization safety contract
• both cache-directory entry points accept group/world-writable directories before files from them reach unsafe native-module deserialization

Relative MapFile destinations are intentionally not rejected here: the stable ZIP integration fixture currently relies on one.

Validation

• every newly added regression test fails at its named acceptance boundary
• the self-dependency integration fixture fails with two root-load records instead of one (charged, then unexpected cached)
• the malformed-registration unit test fails because registration returns Ok(custom:...)
• the short registry hash case panics at the two-character hash bucket slice
• the runner-name traversal case validates an artifact placed outside runners_dir
• both inconsistent ZIP archives are accepted by the parser
• both stale-artifact paths leave prior native modules available after the replacement source is rejected or skipped
• recompiling different modules preserves the same cache-file inode
• both cache entry points accept a mode 0777 directory
• the Speed-precompile versus None-runtime engine compatibility probe passes and was removed rather than committed
• 75 unrelated executor library tests pass with all 24 intentional regression cases excluded
• all five intentional genvm binary regression tests are isolated; no unrelated binary tests exist
• Python lint/format, Rust formatting, JSON parsing, Jsonnet collection, and changed-file diff checks pass

Scope

• tests only
• no dependency traversal, registration, version validation, WASI encoding, path validation, archive parsing, registry validation, cache, or runner fixes

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 81248aa9-8d9e-4e47-acc7-231b8ca92a83

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}