chore(experiments): add io_uring cancel-safety spike (backlog#894)

Standalone-workspace prototype proving the buffer-ownership model P2 requires before any production io_uring work: buffer and fd are owned by the driver's pending table from SQE submission to CQE, dropping the future never reclaims the buffer, IORING_OP_ASYNC_CANCEL only accelerates the CQE, and shutdown drains to in_flight == 0 before the ring is unmapped.

Deliberately excluded from the rustfs workspace (own [workspace] table): P2 stays deferred per the P1.5 NO-GO gate, so io-uring must not enter the main Cargo.lock. Verified via run-docker.sh on a real Linux kernel: default-seccomp leg degrades gracefully (EPERM probe, the #4313 environment), unconfined leg passes all five cancel-safety tests.

Co-Authored-By: heihutu <heihutu@gmail.com>

experiments/io-uring-cancel-spike/run-docker.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Runs the spike test suite in the two environments that matter for P2
+# (backlog#894):
+#
+#   leg 1  default Docker seccomp — io_uring is (usually) blocked, which is
+#          exactly the #4313 incident environment. Tests must degrade to a
+#          graceful skip via the probe, never fail.
+#   leg 2  seccomp=unconfined — real io_uring against the host kernel.
+#          The full cancel-safety suite runs.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+IMG="${SPIKE_IMAGE:-rust:1-bookworm}"
+CACHE_REG=uring-spike-cargo-registry
+CACHE_TARGET=uring-spike-target
+
+run_leg() {
+    local title="$1"
+    shift
+    echo "=================================================================="
+    echo "== $title"
+    echo "=================================================================="
+    docker run --rm "$@" \
+        -v "$PWD":/spike:ro \
+        -v "$CACHE_REG":/usr/local/cargo/registry \
+        -v "$CACHE_TARGET":/spike-target \
+        -e CARGO_TARGET_DIR=/spike-target \
+        -e CARGO_TERM_COLOR=always \
+        -w /spike \
+        "$IMG" \
+        cargo test --release -- --nocapture --test-threads=1
+}
+
+run_leg "leg 1: default seccomp (restricted env expected)"
+run_leg "leg 2: seccomp=unconfined (real io_uring)" --security-opt seccomp=unconfined
+echo "both legs passed"