shadow-core: generic record I/O, locked-file transaction, shared exit errors, feature and dead-code cleanup

[pierre-warnier]

Simplifications in shadow-core and the tool crates that remove code while strengthening invariants. Each is independent; the first two are prerequisites for several bug issues.

1. One generic reader/writer for the five record files. read_*_file/write_* are identical modulo type, and the 33 fields.next().ok_or_else(...) chains have one shape. read_entries<T: FromStr> / write_entries<T: Display> plus a Fields<'a> helper; this is also where raw-line preservation (compat lines, comments) and per-line error context are implemented once.
2. LockedFile<T> transaction: open acquires the lock (and .pwd.lock), reads under it; entries_mut(); commit() writes atomically and releases; Drop releases without writing. Every tool repeats the lock→read→mutate→write→unlock dance ~13 times, and pwck -s gets the order wrong (sorts entries read before the lock). Invariant gained: no read outside the lock, no write after release.
3. One exit-code error type (cli::ExitError { code, msg } or equivalent). The per-tool enum XxxError(String) + Display + UError blocks are the same ~40 lines twelve times; exit_codes constants stay the single source of truth.
4. Cargo features: drop the dependency-free parser features (shadow, group, gshadow, login-defs, subid) — they make cargo test -p shadow-core skip most of the crate and add a cfg(all(...)) on uid_alloc; keep pam, crypt, landlock (they change linkage) and make zeroize/subtle optional under them. In the root manifest, pam = ["passwd?/pam", "chfn?/pam", "chsh?/pam"] (today the feature force-enables the three applets) and delete the unused feat_* aliases.
5. Dead code: process::PwEntry + lookup_username + hardening::lookup_username_by_uid (a field-by-field copy of PasswdEntry); SavedSigSet/block_critical_signals/restore_signals/SignalBlocker are four names for one guard (add SIGQUIT); error::Io, Permission, ShadowResult have no producers or users; pam.rs's unsafe impl Send, display_message(_, _is_error), unused item/flag surface.
6. uid_alloc: one IdRange built from a key pair and one next_free; add the NSS check (getpwuid) so a directory user's UID is never handed out locally.
7. login_defs::get_i64 parses decimal only; login.defs(5) allows octal (leading 0) and hex (0x): UID_MIN 01000 is 512 to GNU and 1000 here; UMASK 022/HOME_MODE 0750 will be misread the day they are honoured.
8. harden_process() returns an environment nobody uses; the doc says the environment is sanitized and it is not. Either sanitize for real (clearenv + the safe set, in the unsafe-permitted process module) or make the function () and keep sanitized_env() private to a safe_command(path) helper shared by nscd/audit. audit can write to /dev/log with a UnixDatagram instead of forking logger.
9. Doc statements that are false and should go with the code they describe: sysroot "--root does an actual chroot" (only some tools), pam PAM_DISALLOW_NULL_AUTHTOK description, hardening names rw_paths/ro_paths that do not exist, atomic "unique across threads" for a single-threaded crate.

[pierre-warnier]

All of this is done except item 3, which I am recommending against rather than
implementing. Merged in #271, #278, #279 and #280.

1. One generic reader and writer. read_*_file and write_* were the same
twenty lines five times over. They delegate to a generic pair in records now,
and the *_with_layout wrappers are gone entirely — after the transaction
landed, one caller was left between them. 200 lines out of shadow-core.

2. LockedFile transaction. open locks and then reads, commit
validates, writes atomically and releases, Drop releases without writing.
Reading outside the lock and writing after releasing it are not expressible.
commit_all writes several files that have to agree, validating all of them
before writing any. No tool holds a FileLock directly any more. A commit
that would write the same bytes now writes nothing, which removed every tool's
hand-written "did anything change" flag.

4. Cargo features. The five dependency-free parser features are gone;
cargo test -p shadow-core runs 181 tests where it ran 20. pam no longer
force-enables the three applets that can use it. The feat_* aliases are gone.

5. Dead code. process::PwEntry was a field-by-field twin of
passwd::PasswdEntry; getpwuid returns the parser's own type now.
ShadowResult, ShadowError::Permission, display_message's unread
parameter, and the duplicated signal guard and terminal lookup are gone.

6. uid_alloc. uid_range and gid_range were the same function twice.
Allocation now asks NSS as well as the file, so an ID belonging to a directory
account is never handed out locally — with an explicit Scope, because a
--prefix run manages another system's files.

7. login_defs::get_i64. Parsed decimal only. That was a silent
misreading: UID_MIN 01000 means 512 and came back as 1000.

8. harden_process. No longer returns a sanitized environment that all
thirteen callers discarded. audit writes to /dev/log directly instead of
forking logger per event.

9. False documentation. sysroot's --root claim was true of five tools
of thirteen; that turned out to be a real divergence, filed as #270 and fixed.
atomic's "unique across threads" is now what the names actually separate.

3. One exit-code error type — not done, deliberately

The twelve per-tool enum XxxError blocks are what let the compiler say
"variant FileBusy is never constructed". That message caught two real
regressions during the work above:

• chage lost the ability to return 5 for a locked file and would have
  reported 15, "cannot find the shadow password file", for ordinary contention.
• pwck lost 5, "can not update the files", and would have reported every
  write failure as 6, "can not sort".

Both were silent behaviour changes no test covered, and the only thing that
noticed either was the unconstructed-variant lint. A shared struct holding an
integer would have swallowed both.

The boilerplate is real — about thirty lines per tool — but it buys a check
that has now earned itself twice in one week. If the duplication is worth
attacking, the way to do it without losing the check is a derive macro over a
per-tool enum, not a shared struct. Happy to reopen for that.