Merge upstream/main (59cf8189) into submodule/base

Sync the base fork with 13 upstream commits (xhci event-processing
dedup + IRQ race fix, randd permission simplification, nvmed TimeSpec
fix, /dev/ptmx, fpath legacy-path cleanup, dynamically-linked init
fix, and more). Brings process_one_event into the tree, satisfying the
verify-fork-functions gate for base.

Conflicts resolved (3 of 8 overlapping files; 5 auto-merged):

- drivers/usb/xhcid/src/xhci/irq_reactor.rs: took upstream's
  process_one_event/EventProcessResult refactor (b2ed85ea) including
  the a01d3ce6 race fix (process events between NoEvent and
  unmasking), and re-applied the Red Bear SPURIOUS_REBOOT quirk on the
  NoEvent warning (downgrade to debug when quirked).

- randd/src/main.rs: took upstream's permission-handling
  simplification (e26db606); re-applied the RB fcntl improvement
  (F_GETFL/F_GETFD/F_SETFL/F_SETFD handling, Linux random_fops xref)
  and the is_cpu_feature_detected early-return cleanup. Dropped
  test_scheme_perms (deleted by upstream's simplification).

- Makefile: kept upstream's new /dev symlink block (dev/null, ptmx,
  random, urandom, zero, tty, stdin/stdout/stderr).

Verified: cargo check clean; 57/57 tests pass (xhcid 35, usbhubd 14,
xhci trb 8); verify-fork-functions.sh --no-fetch base reports all
upstream functions present.

bootstrap/src/exec.rs

@@ -238,8 +238,6 @@ pub fn main() -> ! {
         .openat_into_upper(exe_reference, O_RDONLY | O_CLOEXEC, 0)
         .expect("failed to open init");
 
-    drop(initfs_root_fd);
-
     let FexecResult::Interp {
         path: interp_path,
         interp_override,
@@ -265,24 +263,13 @@ pub fn main() -> ! {
     // null-terminated. Violating this should therefore give the "format error" ENOEXEC.
     let interp_cstr = CStr::from_bytes_with_nul(&interp_path).expect("interpreter not valid C str");
     let interp_path = interp_cstr.to_str().expect("interpreter not UTF-8");
-    let root_fd = FdGuard::new(
-        redox_rt::sys::openat_into_upper(
-            extrainfo.ns_fd.unwrap(), // initns, not initfs!
-            interp_path,
-            O_RDONLY | O_CLOEXEC,
-            0,
-        )
-        .expect("failed to open root fd"),
-    )
-    .to_upper()
-    .unwrap();
     let redox_path = redox_path::RedoxPath::from_absolute(interp_path)
         .expect("interpreter path is not a Scheme-rooted path");
-    let (_, reference) = redox_path
+    let (_, interp_reference) = redox_path
         .as_parts()
         .expect("redox_path is not scheme root path");
-    let interp_file = root_fd
-        .openat_into_upper(reference.as_ref(), O_RDONLY | O_CLOEXEC, 0)
+    let interp_file = initfs_root_fd
+        .openat_into_upper(interp_reference.as_ref(), O_RDONLY | O_CLOEXEC, 0)
         .expect("failed to open dynamic linker");
 
     fexec_impl(