nx_container_image_test.nx

nx_container_image_test.nx -- rootless container running a REAL IMAGE (a prepared rootfs directory, not rootfs="/"). Proves the full oracle-container path: CLONE_NEWUSER + uid/gid map -> unshare(mount|uts|ipc) -> chroot into /tmp/oraclerootfs -> mount /proc -> execve /bin/exit42 (a static sovereign ELF placed inside the image) -> capture 42. This is the racing-bench oracle lane v2.5: a benchmark binary spins up in an isolated sovereign image as an unprivileged user, runs, and the jail tears down with the process. The harness prepares /tmp/oraclerootfs/bin/exit42 before running this. expect_exit: 0. license_tier: ORIGINAL No hw writes (Rule 26).