test(veltro): align campaign readiness checks

[pdfinn]

Summary

• invoke the concurrent task probe from its tracked /dis/tests path
• assert atomic refusal for mixed over-broad provisioning requests and test valid subsets separately
• accept the documented emulator timeout exit on Linux
• treat an empty /tool/paths file as readable

Verification

• tests/host/task_provisioning_test.sh
• tests/host/tools9p_basics_test.sh
• tests/host/tools9p_integration_test.sh (40 passed)
• tests/host/grind_escape_test.sh
• tools/verify-dis-paths.sh

No runtime or campaign configuration changes.

[pdfinn]

Heads-up on merging this one, and it is my doing rather than yours.

This branch predates #560, which stopped tracking compiled bytecode. It has a
.dis file in its diff, so merging hits:

CONFLICT (modify/delete): <path>.dis deleted in HEAD and modified in <branch>.
Version <branch> of <path>.dis left in tree.

Git leaves the file sitting in the working tree, so resolving with git add .
would quietly re-commit bytecode that master deliberately removed. The
resolution is to delete it:

git rm <path>.dis

Or just rebase onto current master, where the file no longer exists and the
conflict does not arise.

Nothing else in the PR is affected — dis/ is a build product now, rebuilt
with:

for d in appl appl/mpeg appl/veltro tests; do (cd $d && mk install); done

hooks/post-merge does that automatically after a pull if you have run
./hooks/install.sh.

Sorry for the friction — five open PRs are in this position because of the
timing.

[pdfinn]

Reads correctly. Three of the four changes are straightforwardly right:

/tests/task_concurrent_probe.dis → /dis/tests/task_concurrent_probe.dis is
the same class of path error #559 dealt with elsewhere — tests/ installs to
dis/tests/, and /tests/... only ever worked because the source tree happened
to be visible. Replacing the inline rc -eq 0 || rc -eq 124 with
emu_timeout_ok puts the documented-exit knowledge in one place.

The provisioning change is the interesting one, and it is a strengthening:
asserting that a mixed over-broad request is refused atomically, with a
separate case for the valid subset, is a better property than asserting partial
narrowing. A partially-granted child is a capability leak; "narrowed to what was
allowed" would have passed while leaking. Splitting the valid subset into its own
case keeps the positive path covered.

One thing to fix in the description rather than the code: the verification list
cites tools/verify-dis-paths.sh, which #560 removed. The equivalent now is

./tools/verify-dis-build.sh

which builds the tree and checks it against tools/dis-manifest.txt.

Also needs the dis/tests/tools9p_test.dis conflict resolved by deleting the
file rather than keeping the branch's copy — see my other comment.