bug: drop_privileges_succeeds_for_current_user test fails as non-root due to initgroups requiring CAP_SETGID

[elezar]

Agent Diagnostic

Discovered during routine mise run test verification on branch test/verify-rust-tests.

Investigation findings:

• cargo test --workspace shows 329 passed, 1 failed, 0 ignored
• Failing test: process::tests::drop_privileges_succeeds_for_current_user in crates/openshell-sandbox/src/process.rs:578
• Root cause: drop_privileges() calls nix::unistd::initgroups() whenever run_as_user is set (line 417). initgroups(3) internally calls setgroups(2), which requires CAP_SETGID / root — even when the target user is identical to the current user.
• Introduced in commit 5e7a2f2d ("fix(sandbox): verify effective UID/GID after privilege drop")
• The test comment states "without needing root" but the initgroups call on the non-macOS path contradicts this.

Affected platforms: Linux (non-macOS). The initgroups call is inside a #[cfg(not(any(target_os = "macos", ...)))] block.

Description

Actual behavior: drop_privileges_succeeds_for_current_user panics with assertion failed: drop_privileges(&policy).is_ok() when run as a non-root user. The initgroups() call returns EPERM.

Expected behavior: The test should pass when run as an unprivileged user, as its stated intent is to exercise the post-condition verification path (GID/UID checks after setgid/setuid) without requiring root.

Reproduction Steps

1. Clone the repo and run as a non-root user
2. cargo test -p openshell-sandbox --lib process::tests::drop_privileges_succeeds_for_current_user
3. Observe failure

Environment

• OS: Linux
• OpenShell: main branch (post-commit 5e7a2f2d)

Logs

---- process::tests::drop_privileges_succeeds_for_current_user stdout ----
thread 'process::tests::drop_privileges_succeeds_for_current_user' panicked at crates/openshell-sandbox/src/process.rs:578:9:
assertion failed: drop_privileges(&policy).is_ok()

failures:
    process::tests::drop_privileges_succeeds_for_current_user

test result: FAILED. 329 passed; 1 failed; 0 ignored; 0 measured

[github-actions]

This issue appears to have been opened without an agent investigation.

OpenShell is an agent-first project - please point your coding agent at the repo and have it diagnose this before we triage. Your agent can load skills like debug-openshell-cluster, debug-inference, openshell-cli, and generate-sandbox-policy.

See CONTRIBUTING.md for the full workflow.

[elezar]

This issue appears to have been opened without an agent investigation.

For what it's worth. This issue WAS opened with agent investigation. My local tests kept failing, and I asked claude why and created this issue and the associated PR after some iteration.