sluicify v0.2.0

Upgrading

• Every slot needs a regex or an allow_any entry; a rules file with a
  bare slot no longer parses. Run the new sluice check on your rules
  before restarting the broker.
• Slot values starting with - are refused unless the slot is listed
  in allow_dash.
• Clients that interpret wire status: -5 is no longer sent (signal
  deaths are 128 + signo); handle -7 (ERR_TIMEOUT) and -8
  (ERR_PEER).

Security

• Slot regexes are anchored as ^(?:…)$, so every branch of an
  alternation must match the whole value and a trailing \$ is not
  taken for an end anchor.
• Every slot needs a regex unless listed in allow_any, and values
  starting with - are refused unless the slot is listed in
  allow_dash (reject reason option_like).
• Fds passed with a malformed request or the wrong fd count are closed
  instead of leaking in the broker.
• Received fds are close-on-exec atomically (MSG_CMSG_CLOEXEC), so a
  concurrent spawn can't inherit another caller's stdio.
• sluice serve refuses to start when another broker is listening on
  the socket path, instead of unlinking it.

Added

• allow_dash and allow_any rule attributes. sluice check lists
  every slot they widen.
• $HOME and $XDG_RUNTIME_DIR (also ${…}) expand in logfile,
  stdoutfile, stderrfile and cwd, once at parse or SIGHUP
  reload. Any other $VAR, or an unset one, is a parse error.
• Wire status ERR_TIMEOUT (-7) when a rule timeout fires; sluicify
  and the example clients exit 124 for it.
• Wire status ERR_PEER (-8) when the caller's SO_PEERCRED can't be
  read (reject reason peer_unknown).
• Manifest: "resolved" (the binary executed) on start events;
  "signal", "timed_out" and "drain_timeout" on exit events when
  set.

Changed

• A child killed by a signal reports 128 + signo.
• With stdoutfile/stderrfile, the reply goes out when the child
  exits. Output from background processes still holding the pipe is
  captured until they close it, or until the rule's timeout + 2 s; the
  exit event is written then.
• An executable that doesn't resolve via exec_path is a reject
  (exe_unresolved) instead of a start/exit pair.
• Rule attribute values: a value starting with a quote is one quoted
  word and may contain ;. Otherwise quotes are literal and ; starts
  a comment unless written \;.
• A per-rule logfile is a parse error.
• sluicify prints one actionable line per error, e.g. No matching rule for command: <cmd> or Broker not running: no socket at <path>.

Removed

• Wire status ERR_SIGNALED (-5).

Fixed

• Spawned children no longer inherit SIGHUP blocked and SIGPIPE
  ignored.
• A timeout is enforced by polling when pidfd_open or poll fails
  (e.g. EMFILE), instead of killing the child at once or never.
• A panicking connection handler or a failed thread spawn no longer
  leaks a concurrency slot or stops the accept loop.
• Requests with trailing bytes, or truncated by the receive buffer, are
  rejected.
• sluice check reports the number of slots, not of slot regexes.
• sluicify reports a non-UTF-8 argument instead of panicking.