test/wcc: carrier ownership repair and driver-contract adaptation

Every surviving carrier now owns its artifacts: checked mkdir/mkdtemp/
fopen acquisition, one all-exit cleanup funnel per carrier, ENOENT-
tolerant checked unlinks, exact-path deletion (rm -rf only for an
owned pid-keyed dir or a .sepwork beneath one), and cleanup failure
fails a passing carrier without overwriting its diagnostic. In the
same pass the carriers adapt to the driver contract this branch lands:
--sep and WW_PKGCACHE are gone, -S and the /tmp/ww_run_<pid> scratch
contract are asserted, and rows whose runtime or reject coverage moved
to test/wcc/data fixtures or test/lang @test owners are trimmed to the
byte/artifact/diagnostic observations only they can make.

Repair and adaptation ride together because most files interleave both
in the same hunks; splitting would manufacture intermediate carrier
states that never existed and cannot run against either driver.

test/wcc/949_missingpkg.c

@@ -17,6 +17,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <errno.h>
 #include <unistd.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
@@ -35,24 +36,28 @@ runwait(const char *cmd)
 static int
 run_miss(const char *bin)
 {
-	int pid = getpid();
-	char tmpdir[64], src[128], errf[128], outb[128], cmd[2048];
-	char rmcmd[160], line[4096];
-	/* source + binary + intermediates + .sepwork all under one tmpdir so
-	 * the compiler's output-derived .sepwork scratch lands here (not bare
-	 * /tmp where unlink/rmdir would never name it) and the single rm -rf
-	 * reclaims it on every exit path. */
-	snprintf(tmpdir, sizeof tmpdir, "/tmp/mp949_miss_%d_d", pid);
-	mkdir(tmpdir, 0755);
-	snprintf(src,   sizeof src,   "%s/mp949_miss_%d.ww",  tmpdir, pid);
-	snprintf(errf,  sizeof errf,  "%s/mp949_miss_%d.err", tmpdir, pid);
-	/* -o a writable stem inside tmpdir (not /dev/null): post-T3 the
-	 * intermediate .combined.ww/.s/.o follow -o, so /dev/null would yield
-	 * an uncreatable /dev/null.combined.ww and mask the missing-pkg fatal. */
-	snprintf(outb,  sizeof outb,  "%s/mp949_miss_%d.out", tmpdir, pid);
-	snprintf(rmcmd, sizeof rmcmd, "rm -rf %s", tmpdir);
+	char tmpdir[] = "/tmp/mp949_miss_XXXXXX";
+	char src[128], errf[128], outb[128], scratch[144], cmd[2048];
+	char line[4096];
+	if (mkdtemp(tmpdir) == NULL) {
+		fprintf(stderr, "949 FAIL: acquire miss workspace\n");
+		return 1;
+	}
+	/* Source, capture, output, and output-derived .sepwork all live under
+	 * this invocation-owned directory. */
+	snprintf(src,   sizeof src,   "%s/miss.ww",  tmpdir);
+	snprintf(errf,  sizeof errf,  "%s/miss.err", tmpdir);
+	/* -o needs a writable stem inside tmpdir (not /dev/null): the
+	 * output-derived .sepwork follows -o, so /dev/null would yield an
+	 * uncreatable /dev/null.sepwork and mask the missing-package fatal. */
+	snprintf(outb,  sizeof outb,  "%s/miss.out", tmpdir);
+	snprintf(scratch, sizeof scratch, "%s.sepwork", outb);
+	int result = 1;
 	FILE *f = fopen(src, "w");
-	if (!f) { fprintf(stderr, "949 FAIL: stage miss\n"); runwait(rmcmd); return 1; }
+	if (!f) {
+		fprintf(stderr, "949 FAIL: stage miss\n");
+		goto cleanup;
+	}
 	fputs("package main;\n"
 	    "import nosuchpkg;\n"
 	    "export fn main() i32 = { return 0; };\n", f);
@@ -63,8 +68,7 @@ run_miss(const char *bin)
 	int rc = runwait(cmd);
 	if (rc == 0) {
 		fprintf(stderr, "949 FAIL: ww accepted a missing import\n");
-		runwait(rmcmd);
-		return 1;
+		goto cleanup;
 	}
 	int found = 0;
 	f = fopen(errf, "r");
@@ -75,13 +79,28 @@ run_miss(const char *bin)
 			}
 		fclose(f);
 	}
-	runwait(rmcmd);
 	if (!found) {
 		fprintf(stderr, "949 FAIL: no 'cannot find package nosuchpkg' "
 		    "on stderr\n");
-		return 1;
+		goto cleanup;
 	}
-	return 0;
+	result = 0;
+
+cleanup:
+	{
+		int bad = 0;
+		snprintf(cmd, sizeof cmd, "rm -rf %s", scratch);
+		if (runwait(cmd) != 0) bad = 1;
+		if (unlink(outb) != 0 && errno != ENOENT) bad = 1;
+		if (unlink(errf) != 0 && errno != ENOENT) bad = 1;
+		if (unlink(src) != 0 && errno != ENOENT) bad = 1;
+		if (rmdir(tmpdir) != 0) bad = 1;
+		if (bad) {
+			fprintf(stderr, "949 FAIL: cleanup miss workspace\n");
+			result = 1;
+		}
+	}
+	return result;
 }
 
 /* inline branch: a single-file multi-package unit whose `import aa` is
@@ -90,18 +109,23 @@ run_miss(const char *bin)
 static int
 run_inline(const char *bin)
 {
-	int pid = getpid();
-	char tmpdir[64], src[128], outb[128], cmd[2048], rmcmd[160];
-	/* source + binary + .sepwork all under one tmpdir so the compiler's
-	 * source-derived .sepwork scratch lands here (not bare /tmp) and the
-	 * single rm -rf reclaims it. */
-	snprintf(tmpdir, sizeof tmpdir, "/tmp/mp949_inl_%d_d", pid);
-	mkdir(tmpdir, 0755);
-	snprintf(src,   sizeof src,   "%s/mp949_inl_%d.ww", tmpdir, pid);
-	snprintf(outb,  sizeof outb,  "%s/mp949_inl_%d",    tmpdir, pid);
-	snprintf(rmcmd, sizeof rmcmd, "rm -rf %s", tmpdir);
+	char tmpdir[] = "/tmp/mp949_inl_XXXXXX";
+	char src[128], outb[128], scratch[144], cmd[2048];
+	if (mkdtemp(tmpdir) == NULL) {
+		fprintf(stderr, "949 FAIL: acquire inline workspace\n");
+		return 1;
+	}
+	/* Source, output, and output-derived .sepwork all live under this
+	 * invocation-owned directory. */
+	snprintf(src,   sizeof src,   "%s/inline.ww", tmpdir);
+	snprintf(outb,  sizeof outb,  "%s/inline",    tmpdir);
+	snprintf(scratch, sizeof scratch, "%s.sepwork", outb);
+	int result = 1;
 	FILE *f = fopen(src, "w");
-	if (!f) { fprintf(stderr, "949 FAIL: stage inline\n"); runwait(rmcmd); return 1; }
+	if (!f) {
+		fprintf(stderr, "949 FAIL: stage inline\n");
+		goto cleanup;
+	}
 	fputs("package aa;\n"
 	    "export fn getv() i32 = { return 7; };\n"
 	    "package main;\n"
@@ -115,16 +139,29 @@ run_inline(const char *bin)
 	if (rc != 0) {
 		fprintf(stderr, "949 FAIL: inline-package build failed "
 		    "(inline-skip branch regressed)\n");
-		runwait(rmcmd);
-		return 1;
+		goto cleanup;
 	}
 	int got = runwait(outb);
-	runwait(rmcmd);
 	if (got != 7) {
 		fprintf(stderr, "949 FAIL: inline-package exit=%d want=7\n", got);
-		return 1;
+		goto cleanup;
 	}
-	return 0;
+	result = 0;
+
+cleanup:
+	{
+		int bad = 0;
+		snprintf(cmd, sizeof cmd, "rm -rf %s", scratch);
+		if (runwait(cmd) != 0) bad = 1;
+		if (unlink(outb) != 0 && errno != ENOENT) bad = 1;
+		if (unlink(src) != 0 && errno != ENOENT) bad = 1;
+		if (rmdir(tmpdir) != 0) bad = 1;
+		if (bad) {
+			fprintf(stderr, "949 FAIL: cleanup inline workspace\n");
+			result = 1;
+		}
+	}
+	return result;
 }
 
 int