ci: fix weekly chaos test fixtures

[fwerkor]

Summary

• run mandatory cross-user FUSE permission checks from a traversable /tmp path instead of the runner-private temp tree
• retain hidden .argosfs metadata in mounted POSIX failure artifacts
• create /dev, /proc, /run, and /sys in the raw block fault rootfs fixture before exercising degraded root preflight

Failure analysis

The manually triggered weekly run failed for two fixture reasons:

• the nobody identity could not traverse ${RUNNER_TEMP}, so the mode 0644 positive-read check was denied before reaching ArgosFS
• the block-fault dataset was not a valid rootfs, so preflight-root --mode degraded-ro stopped on missing switch-root mountpoints instead of validating the injected EIO state

Validation

• parsed .github/workflows/weekly-randomized-model.yml with PyYAML
• bash -n scripts/tests/host/block_fault_injection.sh
• local privileged execution unavailable because this container has no /dev/fuse, /dev/loop-control, or /dev/mapper/control; PR CI provides those capabilities