init: gracefully degrade on setrens failure

The initial bootstrap init (started directly by the kernel) has no
ns_fd in its dynamic proc info. setrens(0,0) calls mkns which needs
a current_namespace_fd() — this returns ENOENT and panics.

Replace the .expect() with a graceful fallback: log a warning and
continue with the full scheme set. This lets init function even when
the null namespace cannot be created (e.g. when the bootstrap
initnsmgr daemon isn't running).

The null namespace is a hardening feature, not a correctness
requirement. Init can still spawn daemons and manage the system
without it.

init/src/main.rs

@@ -194,7 +194,20 @@ fn main() {
         let _ = writeln!(f, "AFTER_STEP");
     }
 
-    libredox::call::setrens(0, 0).expect("init: failed to enter null namespace");
+    // Enter a null namespace containing only memory and pipe schemes. This
+// limits what daemons can access if they crash or misbehave. For the
+// initial bootstrap init (started directly by the kernel), there is no
+// prior ns_fd, so the kernel falls back to the root scheme list. If
+// setrens fails (e.g. ns_fd unavailable), we log a warning and continue
+// — the init process can still function with the full scheme set.
+    if let Err(e) = libredox::call::setrens(0, 0) {
+        eprintln!("INIT: warning, could not enter null namespace: {e}");
+        eprintln!("INIT: continuing with full scheme set");
+        if let Ok(mut f) = std::fs::OpenOptions::new().write(true).open("/scheme/debug/no-preserve") {
+            use std::io::Write;
+            let _ = writeln!(f, "INIT: setrens warning: {e}");
+        }
+    }
 
     loop {
         let mut status = 0;