shim: handle seccomp-trapped pidfd_open so bun child spawn works

[HanSoBored]

Fixes #15

Problem

On Android 10/11 (kernel < 5.3), the app-sandbox seccomp policy TRAPs pidfd_open as SIGSYS. Bun calls it when spawning child processes, so bun x, bun run <script>, and Bun.spawn() all crash:

• bun x cowsay → exit 134
• bun run hi → error: script "hi" was terminated by signal SIGSYS
• Bun.spawn() → exit 159

Root cause is two-fold:

1. Android seccomp TRAPs pidfd_open as SIGSYS instead of returning ENOSYS, so Bun never falls back to waitpid.
2. Bun installs its own SIGSYS crash handler (SA_RESETHAND) at startup, which turns the trap into an abort before the shim can do anything about it.

Fix

In shim.c:

• handle_sigsys: a SIGSYS handler that reports seccomp-trapped syscalls (pidfd_open) as -ENOSYS, the standard "kernel does not provide this syscall" answer, so well-behaved callers fall back to older syscalls. Same technique as opencode-termux's libseccomp-shim.c.
• sigaction() interposition: Bun's own crash reporter installs SA_RESETHAND for SIGSYS, replacing our handler. Interposing sigaction() keeps our handler installed so the fallback actually runs.

Verification

On aarch64 / Android 10 (kernel 4.9.186), Bun 1.3.14:

bun --version          → 1.3.14
bun run hi             → from-script        (was: SIGSYS crash)
bun x cowsay ...       → works              (was: exit 134)
bun --bun x cowsay ... → works
bun install            → works
bun build --compile    → binary runs
Bun.spawn / os.cpus()  → works
tests/run-tests.sh     → 9/9 PASS