redox-rt: make filetable refresh non-fatal (fall back to lseek)

The dup2('refresh') added for O_CLOEXEC/stale-fd correctness fails for some
exec'd children (observed: a uid-dropped, namespace-restricted login shell)
and propagated as a spawn ENOENT. Fall back to the plain lseek when the
refresh syscall errors so process startup always succeeds; the refresh
still applies wherever the kernel permits it. Prevents any spawn
regression while the refresh path is stabilized for restricted children.

redox-rt/src/sys.rs

@@ -974,7 +974,7 @@ impl FdTbl {
         // creation"). A plain lseek did not force the underlying scheme to
         // re-materialize the current descriptor set.
         let buf = b"refresh";
-        unsafe {
+        let refreshed = unsafe {
             syscall::syscall4(
                 syscall::SYS_DUP2,
                 files_reader_fd,
@@ -982,7 +982,14 @@ impl FdTbl {
                 buf.as_ptr() as usize,
                 buf.len(),
             )
-        }?;
+        };
+        // If the kernel cannot refresh this filetable here (e.g. permission or
+        // context constraints for a uid-dropped / namespace-restricted exec),
+        // fall back to the plain lseek so process startup still succeeds —
+        // NON-FATAL so we never break spawn while the refresh path is stabilized.
+        if refreshed.is_err() {
+            let _ = filetable_fd.lseek(0, syscall::flag::SEEK_SET);
+        }
 
         fdtbl.resize(Self::DEFAULT_CAPACITY);