fix(linux): detect stale SELinux labels after game updates

[NullPrism]

Summary

Add an SELinux preflight to the Linux launcher so stale host-executable
labels are detected before UE4SS installs executable-memory trampolines.

Game updates can replace the host executable with a new inode. The
replacement can inherit the directory's default SELinux type instead of the
persistent UE4SS entrypoint type. When this prevents transition into the
scoped UE4SS domain, SELinux can deny execheap, leaving a generated
PolyHook trampoline non-executable and causing a delayed SIGSEGV.

Changes

• Add UE4SS_SELINUX_PREFLIGHT modes:
  • off
  • warn — default
  • strict
• Add UE4SS_EXPECTED_SELINUX_TYPE for scoped deployments.
• Warn for unsuitable default host types such as user_home_t.
• Exit with status 8 in strict mode when the host type is incorrect.
• Add launcher regression tests for warning behavior, strict-mode
  rejection, and a matching expected type.
• Document persistent semanage fcontext mappings.
• Document running restorecon after game updates or validation.
• Document why the global execheap boolean and chcon are unsuitable.

Incident validation

Observed after Palworld Dedicated Server updated to:

• Game version: 1.0.2.100933
• Server SHA-256:
  d16b4d840a30dc3f467fe1059a0088ddb08a4b513cc45150767cba1785867d30

The loader initialized normally and resolved its required signatures, but
faulted when entering the generated EngineTick trampoline.

The audit log showed:

avc: denied { execheap } ... comm=PalServer-Linux ... permissive=0

The updated executable had reverted to user_home_t. Restoring the
persistent palworld_ue4ss_exec_t label caused the process to transition
into palworld_ue4ss_t.

After relabeling:

• The existing UE4SS runtime loaded successfully.
• Palworld reached Event loop start.
• Palworld reported Running Palworld dedicated server on :8212.
• No new SELinux AVCs were generated.
• No Palworld or UE4SS signature changes were required.

Validation

• Linux build: PASS
• LinuxLauncherTests: PASS
• Broad suite excluding established executable-memory hook tests:
  • 28 tests passed
  • 0 tests failed
  • PalworldSignatureTests skipped because no fixture was supplied
• The excluded hook tests produced SELinux execheap denials under
  unconfined_t.

Commits

• 131ca2b2 — fix(linux): detect stale SELinux host labels
• 976af59c — docs(linux): restore host labels after game updates