Avoid epoll alias ownership aborts - #9250

Summary

Fix the debug-profile abort exposed by the coverage run after #9234. select.epoll.fromfd() deliberately aliases its caller's descriptor, but RustPython represented both aliases as OwnedFd. Closing one and later dropping the other violated Rust's exclusive-ownership contract and aborted the process.

• Store Python-visible epoll descriptors in a raw-descriptor holder. Explicit close still reports errors; implicit destruction performs a best-effort close.
• Preserve descriptor aliasing and existing locking. Do not duplicate descriptors or change global Python-to-fd conversion.
• Call raw epoll_ctl and epoll_wait through host_env, using a transparent host-only wrapper over libc's native event layout, including Redox padding. No artificial BorrowedFd lifetime is asserted for descriptors supplied by Python.
• Use CPython-style ceiling-millisecond conversion and reject positive timeouts beyond signed 32-bit milliseconds. Retain the existing outer EINTR/deadline handling.

The patch changes only crates/host_env/src/select.rs and crates/stdlib/src/select.rs. No Lib changes, test skips, assertion edits or CI workflow changes.

Reference and scope

Source commit 75346b7f12 is based on main b4a1ad232f8eb68523ce687183ce08958d4b6744. Its Rust/Cargo source bytes match the locally tested pre-commit tree. Main subsequently advanced to ebb6a78521 with disjoint reflected-multiplication changes; local results are not attributed to that newer merge. The original ownership patch rebased without conflicts; the final follow-up keeps the native event type behind a transparent host-only wrapper to satisfy the existing stdlib lint boundary. Compare pinned CPython 3.15.0 selectmodule.c.

Existing unrelated differences remain: fromfd(-1) raises EBADF in RustPython while CPython's shared constructor creates an epoll; poll(maxevents=0) reaches the syscall and reports EINVAL in RustPython while CPython raises ValueError. These are not hidden by the focused probe.

Validation

• The sealed pre-repair dev binary reproduces the exact IO-safety SIGABRT (exit signal 6, 0.117 seconds) on a bounded alias/drop case using only a descriptor created by that process.
• Pinned CPython 3.15.0 passes all four groups of the focused own-epoll/own-pipe diagnostic (0.034 seconds).
• A fresh locked/offline dev CLI build on the stated base plus this patch passes. Debug symbols are disabled to fit the environment, matching CI's symbol setting; debug assertions, source optimizations, features and overflow checks are not disabled.
• The final matching candidate passes all four focused groups in 0.366 seconds: lifecycle, alias/drop, alias/explicit-close, and owned-pipe register/modify/unregister with returned descriptor/event verification. Additional checks cover zero/tiny/ready-only-negative timeouts, invalid maxevents and positive timeout overflow. Each probe has a ten-second external deadline, disabled core dumps and a bounded output log.
• Independent static review found no blocking issue in ownership, locking, native event layout, packed-field value access, Redox padding or timeout conversion. This is source review, not cross-platform runtime validation.
• Strict Clippy passed for root, host_env and stdlib library/binary targets with -D warnings. Normal configured file hooks passed (merge conflict, rustfmt and cspell; non-applicable hooks skipped normally).

These are focused runtime results, not a full test_epoll pass. The canonical module's shared setup opens sockets, so it was not run locally under the current execution boundary. Full current-source workspace/CAPI tests, all-target lint, instrumented coverage, signal-interruption runtime, and non-Linux runtime validation remain unrun. Earlier ImportError native-suite results belong to different source and are not reused as this patch's validation.

Local full native gates required by the repository guidance remain outstanding; this draft does not present focused checks as their substitute.

AI assistance

Assisted implementation, source review and automated validation by OpenAI Codex. This reports automated checks, not additional human testing. The commit includes an Assisted-by trailer; the exact model version is unavailable.

Summary by CodeRabbit

• Bug Fixes
  • Improved epoll support on Linux, Android, and Redox platforms.
  • Improved handling of polling timeouts, including long durations and interrupted waits.
  • Epoll events now report their associated data and flags more reliably.
  • Invalid file descriptors are rejected with an appropriate error.
  • Improved error reporting for epoll creation, registration, modification, removal, and waiting operations.