Harden hypervisor process liveness checks

[yummybomb]

Summary

Layer 1 of the vendor VFIO vGPU stack (generalize-vgpu-device ← this ← vendor-vfio-backend ← vendor-vfio-vgpu). Pure hypervisor-process hardening with no vGPU-specific code; reviewable in isolation.

The upper layers guard vGPU release decisions on "is this instance's hypervisor still alive", so the liveness answer has to be trustworthy first:

• Unify liveness checks on ProcessExists — one exported, EPERM-aware, zombie-filtering definition instead of scattered bare kill(pid, 0) probes. EPERM means the process exists but cannot be signaled; treating it as dead would be wrong.
• Wait for non-child hypervisor exit before finishing kill — after a hypeman restart the hypervisor is not our child, so Wait4 returns ECHILD immediately and the kill loop finished before the process had exited. Poll for actual exit in that case.
• HypervisorProcessExists: verify socket ownership — a bare PID probe treats any process that reused a stored hypervisor PID as the owning VMM. On Linux, require the PID to own the instance's hypervisor socket before reporting it alive.

Testing

• go build ./..., go vet clean
• go test -race ./lib/instances/ targeted suites pass (TestCreateInstanceWithNetwork requires image pulls + iptables and fails in this environment on the unmodified base as well)

---

Note

Medium Risk
Changes process kill and liveness semantics on delete and PID refresh; incorrect behavior could spare a VMM or kill the wrong process, though the new tests target the stale-PID case explicitly.

Overview
Hardens how hypeman decides whether a hypervisor is alive and which PID to kill on instance delete, so stale or reused PIDs cannot target the wrong process.

Linux socket PID resolution — ResolveProcessPID now returns (pid, confirmed, err) where confirmed is true only when the PID comes from FD ownership, not cmdline fallback. Listener lookup in /proc/net/unix filters on __SO_ACCEPTCON so accepted connections do not duplicate the path, and duplicate listener inodes error instead of picking arbitrarily. /proc scans surface partial read/link failures instead of silently treating them as “not found.”

Unified liveness — Internal processExists is exported as ProcessExists (EPERM-aware, zombie-filtered on Linux). New HypervisorProcessExists(pid, socketPath) requires socket ownership on Linux before treating a stored PID as the VMM.

Delete path — killHypervisor only SIGKILLs a PID verified via HypervisorProcessExists, or a confirmed socket owner when metadata PID is wrong; unrelated processes that reused a stale PID are left alone. The post-SIGKILL wait loop no longer exits early on Wait4 ECHILD for non-child hypervisors; it polls until the process is actually gone.

^{Reviewed by Cursor Bugbot for commit 78fc483. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a187984. Configure here.}