Add file-capability allowlist option

[lvaroqui]

No description provided.

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds file-capability allowlist option to Valgrind core.

The PR appears safe to merge, though the earlier non-blocking request for broader permission-check coverage remains open.

Findings

1.  Capability override lacks regression tests ▶

Fix with agent prompt

### Issue 1
coregrind/m_libcfile.c:1105-1106
The new tests cover description registration, but none exercises this permission check. A test with matching and nonmatching file-capability executables, a setuid or setgid executable, and a traced child would catch a change that silently disables or broadens the override.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR adds an opt-in executable-name pattern override for running file-capability executables without their capabilities. Since the previous review, it also adds CI support and regression tests for matching and nonmatching traced children.

_{Reviews (2) · Last reviewed commit: "feat: add --allow-file-caps to run execu..."}

[codspeed]

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 60 skipped benchmarks¹

---

_{Comparing cod-3722-ignore-process-spawning-overhead-in-exec-harness-simulation (c1a37ef) with master (0540362)}

Footnotes

1. 60 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩