ci(python): contain and sample the experimental legs so a lost runner becomes a warning (#1740)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Refs #1740. The owner's rule is that a non-blocking leg may fail only as a warning, and its check must stay green. GraalPy's leg keeps losing its runner 18–30 minutes into its tests, and a lost runner fails the check no matter what continue-on-error says. This keeps the runner alive, so a resource breach fails the step instead, and that is already a warning.

• Monitor: a detached sampler runs outside the cap. Every 30 seconds it logs memory, disk, load, the top processes by RSS, and the OOM-kill count, as [monitor] lines in the tests' log, uploaded if: always().
• Containment:
  • GraalPy gets --vm.Xmx2g and -n 3; 3.14t keeps auto.
  • pytest runs under timeout --signal=INT --kill-after=3m 110m and prlimit --fsize=2 GiB, inside a 12 GB, swapless, CPUWeight=20 systemd-run --scope.
  • The probe uses the same flags. If it fails, the tests run uncapped on the same argv, and the log says so.
• Containment summary, a new step, warns separately on no cap, an OOM kill, a timeout (exit 124, or 137 after 110 minutes) and a MemoryError, each with the last sample. Experimental summary is byte-identical to main's.
• Timing: at -n 3, GraalPy likely needs about 117–151 minutes (an inference), so it may end on the 110-minute timeout as a warning. That is expected and non-blocking. Caps, check names and jobs are unchanged.
• Tests: tests/project/test_resource_monitor_1740.py, with sudo always stubbed. 1672's list of steps that carry LEG gains Containment summary.
• Real-runner only: passwordless sudo plus systemd-run, the cgroup path, and whether the sizes keep the runner alive. This PR's own Experimental Tests run is the first evidence.

[JarryShaw]

Verdict: GOOD TO GO at ddbd9a3b0. A Sonnet cross-review checked it over three rounds (author: Opus). Round 2 broke 1672, and round 3 fixed it.

• Full project tier: all 48 tests/project/*.py files, plus tests/test_tier_guard.py, pass one at a time. A decoy sudo was never reached, and no tail was left behind.
• Mutants: round 2's surviving one, a fallback running bare pytest -q, is now caught by the argv pin. Across the earlier rounds 16 of 18 were killed, including GraalPy settings leaking to 3.14t, 110m changed to 120m, a dropped prlimit, tee instead of PIPESTATUS, and dropped uid, --preserve-env, PATH or LD_LIBRARY_PATH.
• Sources: checked for sudo dropping LD_* (env.c:133-141), systemd scope semantics (run.c), and GraalPy's GRAAL_PYTHON_VM_ARGS (GraalPythonMain.java:232).
• Unchanged: Experimental summary is byte-identical to main's, and nothing gating changed.
• My own re-run in the PR's tree: 1740 (26 passed), 1672 (19) and 1738 (13).
• Real-runner only: sudo systemd-run, the cgroup path, and whether the sizes hold. This PR's own Experimental Tests run is the first evidence.

[github-actions]

Coverage: 89.57% (unit tier, Python 3.15, ddbd9a3b0, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18860	954	2368	868	91.06%
pcapkit/corekit	2457	69	780	35	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2906	164	1016	34	93.57%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17174	225	4588	190	98.07%
pcapkit/toolkit	864	182	298	9	76.33%
pcapkit/utilities	512	2	158	4	99.10%
pcapkit/vendor	4417	2342	1010	157	43.38%

Per-file detail: the coverage-html artifact of this run.