perf(daemon): hash the executable image once per process; announce missed hook deadlines

The build-identity fingerprint is a SHA-256 over the entire ~295 MB
executable: ~1.1 s per hash on an M5 Pro, ~2.3 s on the machine where
this was first measured. A daemon pays it twice at start: the
supervisor's startup capture and the runtime service's active-image
check.

- Cache the fingerprint per process at
  runtime_process_image_reference_acquire, keyed by (device, inode,
  size, mtime, change time): the identity the acquire path already
  verifies as stable across the hash, so a rebuilt or replaced binary
  rolls the key. On Windows the change time is
  FILE_BASIC_INFO.ChangeTime, which the kernel maintains and SetFileTime
  cannot reset. Every hit is still bracketed by the same before/after
  stat and process-maps checks, so a cached digest stays bound to the
  verified image. A freshly hashed digest is committed only after the
  acquire chain, including the post-hash stat check, has passed, and
  only under the identity observed after the hash, so an image that
  changed under the hash is never cached. The cache is process-local:
  it removes the daemon's second start-up hash (cold start 6.5 s ->
  5.3 s with a 296 MB image); a fresh hook process still hashes its own
  image once.
- A missed hook deadline is announced on stderr as well as the timeouts
  log, so a fired deadline is never a silent 0-byte exit 0. The
  breadcrumb is formatted before the log path is resolved, so stderr
  gets it even when the log cannot be opened. CBM_HOOK_DEADLINE_MS is
  unchanged.

SHA-256 itself is unchanged: one portable scalar implementation on every
platform.

Refs #1335, #2058

Signed-off-by: Brian McNaboe <bmcnaboe@gmail.com>

Author: bmcnaboe

src/cli/hook_augment.c

@@ -96,14 +96,31 @@ static size_t g_ha_crumb_len = 0;
 
 static void ha_deadline_exit(int sig) {
     (void)sig;
-    if (g_ha_crumb_fd >= 0 && g_ha_crumb_len > 0) {
-        ssize_t w = write(g_ha_crumb_fd, g_ha_crumb_msg, g_ha_crumb_len);
-        (void)w;
+    /* async-signal-safe only: write() the prepared breadcrumb to the timeouts
+     * log (when it opened) and ALWAYS to stderr, so a fired deadline is a
+     * visible event, never a silent 0-byte exit(0). */
+    if (g_ha_crumb_len > 0) {
+        if (g_ha_crumb_fd >= 0) {
+            ssize_t w = write(g_ha_crumb_fd, g_ha_crumb_msg, g_ha_crumb_len);
+            (void)w;
+        }
+        ssize_t e = write(STDERR_FILENO, g_ha_crumb_msg, g_ha_crumb_len);
+        (void)e;
     }
     _exit(0);
 }
 
 static void ha_open_crumb_log(int deadline_ms) {
+    /* Pre-format the breadcrumb unconditionally: the handler may only write() a
+     * prepared buffer, and formatting it before the log path is resolved means
+     * stderr still gets the line even when the file cannot be opened (no HOME,
+     * unwritable cache dir) — the "never silent" guarantee holds regardless. */
+    int n = snprintf(g_ha_crumb_msg, sizeof(g_ha_crumb_msg),
+                     "hook-augment: deadline_exceeded ms=%d pid=%ld (raise via "
+                     "CBM_HOOK_DEADLINE_MS)\n",
+                     deadline_ms, (long)getpid());
+    g_ha_crumb_len = (n > 0 && n < (int)sizeof(g_ha_crumb_msg)) ? (size_t)n : 0;
+
     const char *override = getenv("CBM_HOOK_TIMEOUT_LOG"); /* tests + power users */
     char path[CBM_SZ_1K];
     if (override && override[0]) {
@@ -119,14 +136,6 @@ static void ha_open_crumb_log(int deadline_ms) {
         snprintf(path, sizeof(path), "%s/hook-augment-timeouts.log", dir);
     }
     g_ha_crumb_fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0644);
-    if (g_ha_crumb_fd < 0) {
-        return;
-    }
-    int n = snprintf(g_ha_crumb_msg, sizeof(g_ha_crumb_msg),
-                     "hook-augment: deadline_exceeded ms=%d pid=%ld (raise via "
-                     "CBM_HOOK_DEADLINE_MS)\n",
-                     deadline_ms, (long)getpid());
-    g_ha_crumb_len = (n > 0 && n < (int)sizeof(g_ha_crumb_msg)) ? (size_t)n : 0;
 }
 
 int cbm_hook_augment_deadline_ms_for_testing(void) {