refluxfs: wire the --full-chain /etc/passwd root pop (🟡 trigger -> 🟢 full chain)

Promotes refluxfs (CVE-2026-64600) to a 🟢 full-chain module. VM-verified
end-to-end on Rocky Linux 9.8 / 5.14.0-687.10.1.el9_8.0.1.x86_64 under
qemu/KVM, unprivileged uid=1000, SELinux Enforcing:

  skeletonkey --exploit refluxfs --i-know --full-chain

reflink-clones /etc/passwd, races the CoW window (32 writers / 8 helpers),
strips root's password field on-disk (root❌ -> root::, the public PoC's
technique), evicts the stale page cache, verifies via O_DIRECT and returns
EXPLOIT_OK. `su root` (empty password) then gives uid 0. 3/3 wins on a
private-extent target (1244/3716/7913 rounds, 4-30s).

Safety properties (this bug rewrites the block device permanently, unlike
the page-cache 🟢 modules):
  - Crafts the payload FIRST and refuses unless it can preserve both root
    and the invoking user's line; every other passwd line is kept
    byte-for-byte. A tail-truncating port drops sshd/nobody/the caller and
    bricks login (hit exactly this during development).
  - Backs /etc/passwd up before the race; restores on failure; cleanup()
    restores it (run as root after the pop).
  - Destructive path gated behind --full-chain. Plain --exploit / --auto
    run only the safe own-files trigger (EXPLOIT_FAIL), unchanged.

Exploitability constraint discovered during verification (NOT in the Qualys
writeup): the race only fires when the target's extent is PRIVATE going in.
The block starts at refcount 2 (target + attacker clone), the concurrent CoW
drops it to 1, and the stale writer reads "1 -> private". A file already
reflink-shared with a third file keeps a post-CoW refcount > 1 and is NOT
attackable via that target. Stock Rocky 9 ships /etc/passwd pre-shared and
was unattackable across ~41,000 rounds; rewriting it to a private extent
(byte-identical content, as any useradd/passwd/vipw does) made it fall in
~2,000 rounds. So the exploitable state is the normal administered state.

Also fixed a page-cache staleness bug in the win path: the overwrite
bypasses the target inode, so its clean cached pages are never invalidated
and a buffered read (getpwnam in `su`, or the module's own verify) would see
the OLD passwd. The module now issues POSIX_FADV_DONTNEED on a win and
verifies via O_DIRECT.

detect() --active gains a per-target extent-privacy check: it reports
whether /etc/passwd is private (attackable) or already-shared (not).

88-test unit harness still green (148 total). Docs updated: MODULE.md
(full-chain flow, private-extent precondition, verification tables),
NOTICE.md, CVES.md (🟢 + tier/ops tables), README (15 full-chain / 13
primitive; lands-root list), RELEASE_NOTES, targets.yaml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

README.md

@@ -54,14 +54,15 @@ VM sweep, not by missing code.
 
 | Tier | Count | What it means |
 |---|---|---|
-| 🟢 Full chain | **14** | Lands root (or its canonical capability) end-to-end. No per-kernel offsets needed. |
-| 🟡 Primitive | **14** | Fires the kernel primitive + grooms the slab + records a witness. Default returns `EXPLOIT_FAIL` honestly. Pass `--full-chain` to engage the shared `modprobe_path` finisher (needs offsets — see [`docs/OFFSETS.md`](docs/OFFSETS.md)). |
+| 🟢 Full chain | **15** | Lands root (or its canonical capability) end-to-end. No per-kernel offsets needed. |
+| 🟡 Primitive | **13** | Fires the kernel primitive + grooms the slab + records a witness. Default returns `EXPLOIT_FAIL` honestly. Pass `--full-chain` to engage the shared `modprobe_path` finisher (needs offsets — see [`docs/OFFSETS.md`](docs/OFFSETS.md)). |
 
 **🟢 Modules that land root on a vulnerable host:**
 copy_fail family ×5 · dirty_pipe · dirty_cow · pwnkit · overlayfs
 (CVE-2021-3493) · overlayfs_setuid (CVE-2023-0386) ·
 cgroup_release_agent · ptrace_traceme · sudoedit_editor · entrybleed
-(KASLR leak primitive)
+(KASLR leak primitive) · refluxfs (CVE-2026-64600, `--full-chain`:
+`/etc/passwd` root pop on a private-extent XFS target)
 
 **🟡 Modules with opt-in `--full-chain`:**
 af_packet · af_packet2 · af_unix_gc · cls_route4 · fuse_legacy ·
@@ -228,9 +229,14 @@ victim's inode is never written, its `mtime`/`ctime`/size never change
 and **file-integrity monitoring cannot see it**. Unprivileged, no userns,
 no crafted image — reachable wherever an XFS volume is mounted
 `reflink=1`, the installer default on RHEL/CentOS/Rocky/Alma/Oracle 8-10,
-Fedora Server ≥ 31 and Amazon Linux 2023. Shipped as a reconstructed
-trigger confined to files the operator owns, with the `/etc/passwd`
-overwrite → `su` → root step documented but **not** bundled),
+Fedora Server ≥ 31 and Amazon Linux 2023. **🟢 VM-verified full chain**:
+`--exploit refluxfs --i-know --full-chain` reflink-clones `/etc/passwd`,
+races the CoW window, strips root's password on-disk and returns
+`EXPLOIT_OK` (`su root`, empty password → uid 0) — confirmed on Rocky 9.8,
+every other account preserved, backed up + restorable. One caveat found
+in testing: the target's extent must be **private** going in (an
+already-shared file isn't attackable; normal `useradd`/`passwd` churn
+makes it private). Plain `--exploit` runs only a safe own-files trigger),
 `ghostlock` (CVE-2026-43499,
 VEGA / Nebula Security's "GhostLock" — a ~15-year rtmutex/futex requeue-PI
 use-after-free on **kernel stack** memory where `remove_waiter()` clears