test(uffd): switch cross-process helper to page-state snapshots

[ValentaTomas]

Summary

Splits out the pure test-infra slice from #1896 so the REMOVE-event work
can land in smaller, reviewable pieces.

The cross-process userfaultfd test harness currently reports a flat list
of faulted offsets. REMOVE-event tests need to distinguish between
pages that were faulted, pages that were removed, and pages that were
never touched. This PR migrates the wire format and helper API to a
per-state snapshot of the handler's pageTracker so the follow-up PR
can plug in REMOVE handling without further harness changes.

• cross_process_helpers_test.go:
  • New pageStateEntries() on Userfaultfd snapshots every tracked
    page + its state under settleRequests.
  • Emit one pageStateEntry{State uint8, Offset uint64} per page
    over the existing offsets pipe (binary-friendly, fixed-size
    records).
  • Replace offsetsOnce with pageStatesOnce, which decodes the new
    wire format into handlerPageStates.
• helpers_test.go: introduce handlerPageStates with
  allAccessed(), which returns the sorted union of offsets the
  handler touched in any non-missing state. Only faulted is exposed
  for now; the follow-up adds more state-specific fields without
  touching call sites.
• missing_test.go / missing_write_test.go: switch from
  h.offsetsOnce() + assert.ElementsMatch to
  h.pageStatesOnce().allAccessed() + assert.Equal (both sides are
  sorted, so the comparison is stricter).

No behavior change for MISSING-only handling. This is preparation only.

Follow-ups

• feat(uffd): handle UFFD_EVENT_REMOVE in Serve — adds
  pageState removed, pageTracker.get(addr), the REMOVE batch
  handling in Serve, deferred-fault retry, gated pause/resume test
  knobs, and remove_test.go.
• feat: wire freePageReporting through template / build / sandbox / FC
  (capstone that turns the feature on).

Splits #1896 as discussed there.

Test plan

• go build ./...
• go vet ./pkg/sandbox/uffd/userfaultfd/...
• golangci-lint run ./pkg/sandbox/uffd/userfaultfd/...
• CI: TestMissing* and TestParallelMissing* pass on the runner
  (userfaultfd requires privileged execution which isn't available
  on a dev laptop).

[cursor]

PR Summary

Low Risk
Low risk: changes are confined to the userfaultfd cross-process test harness and assertions, with no impact on production fault-handling logic. Main risk is test flakiness/hangs if the new binary stream decoding blocks or if helper output ordering differs across runs.

Overview
Updates the cross-process userfaultfd test harness to request and decode a snapshot of the helper process’ tracked pages as (state, offset) entries (instead of a flat list of offsets), exposing this via pageStatesOnce()/handlerPageStates and adjusting MISSING read/write tests to assert against the sorted union of accessed offsets derived from these state snapshots.

^{Reviewed by Cursor Bugbot for commit ca80f8f. Bugbot is set up for automated code reviews on this repo. Configure here.}