feat(attachmux): add the stdio multiplexing package for multi-session attach

[ekalinin]

First step towards multi-session nerdctl attach (#3570, #4374). Design discussion is in #3570 (comment).

This PR adds the pkg/attachmux package and nothing else.

Why

A container's stdio FIFOs cannot be shared: a FIFO has one queue, so two attach sessions each receive a random subset of the container's output. The fix is to give each container a single owner of its stdio and make every CLI session a client of it over a unix socket. This package is both halves of that conversation.

What is here

file
proto.go	frame format: one stream byte, three reserved, big-endian length, payload
broker.go	server side: fan-out to sessions, fan-in of stdin, bounded per-session queues
client.go	client side, used later by attach, run -it and start -a
socket_supported.go	unix socket transport, built for linux and freebsd
socket_unsupported.go	stubs returning ErrUnsupported elsewhere
attachmux.go	package doc, ErrUnsupported, SocketPath

The invariants this package exists to guarantee

Each of these is a bug in attach today, and each has a test:

• The container never blocks on a session. Every session gets a bounded queue and its own writer goroutine; one that falls behind is disconnected. The goroutine feeding the broker never waits on a consumer. This is the structural fix for the deadlock class in nerdctl run with attached stdio stops draining container stdout at ~72 KiB, deadlocking the container (nerdctl 2.3.5, containerd 2.3.3, Kata runtime-rs) #5137 / Fix foreground stdio deadlock when the internal logging process stops consuming #5151.
• With no sessions attached the broker keeps draining, so detaching leaves the container running normally.
• Close(exited bool) only claims an exit when the caller knows there was one. The owner's stdio reaching EOF is not evidence: the same happens when the logging process is shut down while the container keeps running, and a client treats the exit frame as proof and stops streaming.
• The exit frame does not travel through the session queue. The writer delivers it after the queue drains, so a session whose queue is exactly full still learns the container exited rather than seeing a bare EOF.
• Close never waits on a blocked stdin write. It takes the descriptor out under the state lock and closes it after the sessions have drained; a write blocked on a FIFO the container stopped reading is evicted by the runtime poller rather than holding up shutdown.

Testing

go test -race ./pkg/attachmux/..., 23 tests. Run repeatedly (-count=5, several rounds) on linux/arm64 because a good half of them are about concurrency: slow-session eviction, Close racing with a detaching session, SetStdin racing with Close.

golangci-lint is clean for linux, windows, freebsd and darwin.

Notes for review

• The transport is built for linux || freebsd only, matching where the owner process will be built in a later step. Probe returning success where no broker can exist would be a capability check that lies.
• SocketPath is a pure function of the data store, namespace and container ID, deliberately with nothing recorded on disk. The reasoning, including why it cannot live in $XDG_RUNTIME_DIR, is in the issue comment linked above.
• Left as a draft while the design question in Multiple attach should be supported #3570 is open: if the stdio owner ends up somewhere other than the internal logging process, this package stays as it is, but the steps after it change.