fix: workload log streaming and cgroup metrics path

[CodeMaster4711]

Stacked on #213.

Two independent bugs, both confirmed via source trace (no speculation):

1. Metrics always null: the agent read cgroup stats from a path built from the full workload UUID, but the jailer creates the cgroup under the 8-char short id (jailer_short_id). Path never existed, .ok()? swallowed the failure silently. Fixed the path construction and added WARN logging so this class of bug surfaces in logs going forward.

2. Log stream stuck pending forever: two stacked defects.

   • Gateway and agent both returned a bare Body::from_stream(...) with no explicit content-type or initial frame, so hyper deferred flushing response headers until the first body byte arrived — explains zero status code and zero bytes in the browser network tab.
   • In csfx-guest-init, the container's stdout/stderr pipe write ends were moved into the spawn_blocking closure that builds the container and dropped when it returned, so the read side never saw further data after container start. Now cloned into the container builder and the originals kept alive for the guest-init process lifetime.

Verified with cargo check against the real x86_64-unknown-linux-musl target for csfx-agent and csfx-guest-init, and native target for api-gateway. No new warnings introduced.

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2026-0235 rkyv@0.7.46: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2026-0235 rkyv@0.7.46: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels