Skip the entire test module during collection when boxlite.NetworkSpec
is unavailable (native extension not built), preventing AttributeError
during pytest collection in CI. Matches existing pattern in
test_secret_substitution.py.

https://claude.ai/code/session_01KVHFk3e8xxVeAP2rruYUYV

Guard Python test_network_spec.py against missing native extension
(matches existing pattern in test_secret_substitution.py). Skip Go
integration tests on ErrUnsupported/ErrUnsupportedEngine instead of
failing when KVM is not available.

Linux clang-tidy in strict C11 mode requires _XOPEN_SOURCE=500 for
nftw, lstat, FTW_DEPTH, and FTW_PHYS. Add the define to CMakeLists.txt
compile definitions and clang-tidy invocation flags.

The watchdog pipe was created with libc::pipe() which does not set
FD_CLOEXEC. Between pipe creation and the shim's exec(), any child
process spawned by the parent (or by threads in the tokio runtime)
inherits the pipe write-end. When the parent dies, the inherited
write-end keeps the pipe open, so POLLHUP never fires on the shim's
watchdog thread — the shim lives forever as an orphan.

Evidence: lsof showed Electron (VS Code) holding fd 90 as the
write-end of an orphan shim's watchdog pipe, with 127 orphan shim
processes exhausting hypervisor handles (libkrun EINVAL).

Fix: use pipe2(O_CLOEXEC) on Linux, pipe() + fcntl(FD_CLOEXEC) on
macOS. The read-end's CLOEXEC is harmless because pre_exec dup2()
clears it on the target fd.

Includes regression test that spawns a child process and verifies
POLLHUP fires within 100ms after dropping the Keepalive.