fix(workbench): harden portable runtime checks

[timothy-le7]

Summary

• Fail closed when the Sim2Real benchmark cannot create its required Linux mount namespace.
• Make FiftyOne service-file ownership use the operator's actual primary group.
• Harden Isaac cache setup: correctly clear EULA acceptance in the refusal probe and report a missing lock primitive without entering a long retry loop.
• Make hermetic runtime tests portable across supported Unix hosts, including short AF_UNIX test paths and host-specific Terraform cache assertions.
• Correct ShellCheck directives and shell expansion syntax.

Validation

• ruff check npa
• pytest npa/tests/guardrails -q -n auto — 3441 passed
• LeIsaac matrix — 370 passed, 1 skipped
• FiftyOne security/CLI/private-access — 89 passed
• Sim2Real benchmark tests — 97 passed
• Isaac bootstrap tests — 76 passed
• Deploy and Terraform-lock tests — 88 passed
• bash scripts/build_docs.sh --check
• Shell syntax, ShellCheck errors, staged confidentiality scan, and Gitleaks

Validation limitation

The configured Nebius IAM readiness check timed out, so no provisioning or GPU capacity workload was submitted. The full serial suite was restarted during the audit and exposed the host-portability issues fixed here; the repaired targeted matrices above pass. Parallel full-suite execution is currently not isolation-safe on this host and is not treated as a passing signal.