fix(minvmd): bridge-socket permissions, boot bench hardening, exec example - #382

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/minvmd/examples/exec.rs`:
- Around line 93-103: The code currently treats a missing guest ExitStatus as
host success by calling exit.unwrap_or(0) before std::process::exit; change the
fallback to a non‑zero code and consistently map the ExitStatus to an i32 (for
example replace std::process::exit(exit.unwrap_or(0) as i32) with
std::process::exit(exit.map(|c| c as i32).unwrap_or(1))) so that absent/aborted
exec flows return failure; apply the same fix to the other identical block
referenced (lines ~209-221) in the exec example.

In `@scripts/bench-minvmd-boot.sh`:
- Around line 29-30: Add a preflight check for the timeout utility similar to
the existing perl check: use "command -v timeout >/dev/null || { echo \"timeout
required for run-time limiting\" >&2; exit 1; }" placed near the existing
"command -v perl" line (and add equivalent checks where timeout is assumed at
the other spots referenced). Update the script symbols around the perl check and
the warmup/measurement blocks that call timeout so the script exits early with a
clear error if timeout is missing.
- Around line 56-57: The script currently uses substring matching (grep -q
vm-up) against the output file ($OUT) which can falsely succeed; change the
checks that look for readiness to perform exact-line matching (use grep -Fxq or
grep -x for the exact "vm-up" line) wherever the script checks for vm-up (the
boot verification blocks that use BOOT_TIMEOUT, BIN, and OUT, including the
second check later in the file). Ensure the readiness test matches the whole
line "vm-up" only and fail the boot path if no exact match is found.

---

Outside diff comments:
In `@scripts/bench-minvmd-boot.sh`:
- Around line 19-20: Validate the N parameter (set via N="${1:-10}") before
entering the loop: check that N is a positive integer (e.g., match against a
regex like '^[1-9][0-9]*$' or use a safe arithmetic test) and if it fails print
a clear error referencing N and exit non-zero; leave BIN handling as-is and only
proceed to the loop when N is valid.

---

Nitpick comments:
In `@crates/minvmd/src/sock.rs`:
- Around line 197-205: The test enforce_socket_permissions_tightens_to_0600
currently creates a regular file instead of a Unix domain socket, so replace the
File::create(&path) call with creation of a real Unix socket (e.g. bind a
std::os::unix::net::UnixListener to path) before setting permissions and calling
enforce_socket_permissions and verify_socket_permissions; ensure the listener is
created at that path (and dropped/closed if needed) so the test exercises socket
inode permissions rather than a regular file.