Breaking: spawnWrapper now returns Error|null (was stderr/true) and fires the
callback at most once; removeUser/addUserToGroup pass Error|null instead of the
raw exit code. addUser/addGroup propagate errors and no longer call back twice.
addSSHtoUser no longer crashes on a missing user and uses spawn (no shell exec)
to avoid homedir injection. getExpiration returns the error instead of throwing
and parses chage output under the C locale. setPassword reports non-zero exits.
build_user_command no longer injects null argv. getUsers/getGroups no longer
drop the last record without a trailing newline. promise() no longer hangs on
the synchronous validateUsername.

Added: require('linux-user/non-root') read-only subset (no root warning), read-
only promise set (promise.nonRoot()), and optional spawn timeout support.

Types: selinux_user -> string, other_args -> string|string[], plus nonRoot and
promise typings.

Tests now auto-skip root-dependent cases when not running as root.

Co-Authored-By: Claude <noreply@anthropic.com>