Make ProxyNetwork CA cleanup fail closed

[bbartels]

ProxyNetwork cleanup errors were discarded, allowing successful cache or export results to retain BuildKit’s temporary CA. Bundles without trailing newlines were also not restored byte-for-byte.

Changes

• Fail-closed executors
  • Propagate cleanup failures from runc and containerd executors.
  • Join cleanup and process errors so both causes remain discoverable.

err = stderrors.Join(
    err,
    errors.Wrap(cleanupErr, "failed to clean up proxy CA"),
)

• Exact bundle restoration

  • Keep the separator newline inside the removable injected block.
  • Preserve empty bundles, trailing-newline state, and build-time bundle changes.

• Cache safety

  • Bump the ProxyNetwork cache salt from v0 to v1.
  • Leave non-ProxyNetwork and --network=none cache identities unchanged.

• Regression coverage

  • Cover exact restoration, deleted bundles, oversized cleanup failures, combined process/cleanup errors, and exporter suppression.
  • Exercise both rootful OCI/runc and containerd workers.

• Lifecycle documentation

  • Document fail-closed behavior, crash recovery invariants, and trust-store scope limitations.

[bbartels]

Hi @crazy-max, unsure what the right process is to ask for a review, but would be keen to see this get merged :)