fix(worker): restore getpwnam execuser-existence check (bug-1507 merge regression)

The scheduler-framework merge (4e894d21) reverted the bug-1507 fix from
c091a8da: job_start_local_task fell back to nobody only when execuser was
EMPTY, not when it does not exist on the worker host — a submit-user missing
from /etc/passwd makes systemd fail the worker unit with EXIT_USER (217) and
every job dies. Restored the getpwnam() existence check (+ #include <pwd.h>).
All 21 worker tests pass; fallback log message verified in the built xcecd.

Also records the merge-overwrite lesson in cerebrum Do-Not-Repeat: after any
branch-sync merge, re-verify each previously-fixed bug's marker symbol
survived (git show <merge>:<file> | grep -c <symbol> vs <merge>^).

.wolf/memory.md

@@ -7406,3 +7406,4 @@
 | 15:5x | controller full suite 3 FAILs root-caused: Rongsong WAL_JOB_DISPATCH replay tests assert JOB_STAT_RUN after persist_recover, but our bug-1509 B3 (mark_all_run_jobs_unknown_in_memory in persist_recover, p->cluster set) ORs JOB_STAT_UNKWN|TRANSIENT onto RUN. Reconciled by updating the 3 tests (test_wal_job_dispatch_fact.c x2, test_dispatch_commit.c x1) to assert JOB_IS_RUN (base RUN recovered, Rongsong's intent incl. bug-1678 allocs) + UNKWN flag set (our B3). Both groups pass. | controller/testsuite/*.c | 6+4 tests OK | ~2k |
 | 10:3x | merged 集群重启+验证：nix build '.#xce' 产出 w96pv5-xcecore（含 pending_after 修复）；AppRun/runtime 被 nix-store --gc 清掉 → package.sh 用旧 AppImage 提取的 AppRun + 拆出的 runtime ELF 前缀打包，但 `find(b'hsqs')` 命中了 runtime 内部数据 → runtime 被截断（22460B），新 AppImage --appimage-extract 崩 SIGILL。绕过：unsquashfs -d 解包 squashfs 到 /opt/xce/appimage/squashfs-root + touch marker 让 start-cluster.sh 跳过 --appimage-extract（t1 用真实 nix store w96pv5）。集群起来：jobs submit(含 from_host)→RUN→DONE→kill 全通，hosts max_slot=8/NUM_RUN/HOST_TYPE 正常。**新发现 merge 回归**：Rongsong clib.go 覆盖了我们的 bug-1490 修复（ControlJob 的 ctrl.action 应映射到 capnp JobControl union 判别值 0/1，不是 Go JOB_* 常量 1/2/3/8）→ 所有 kill/stop 都 -22 EINVAL。已恢复 `ctrl.action = C.int(jobCtrlDiscriminant(action))`（helper 在 convert_pure.go:30 还活着）+ 重建 apiserver 到 /tmp/apiserver_merged2 + 重启 apiserver，kill 验证通过。待办：重建 xce(含 clib.go 修复)+打包 AppImage 做干净部署；修 AppImage runtime（从 nixpkgs 重建 AppRun+runtime）。 | persist.c, clib.go, start-cluster.sh, package.sh | 集群 OK；bug-1490 回归已修 | ~4k |
 | 11:5x | 遗留项处理完成：(1) 重建 xce 含 clib.go 修复 → 新 xcecore zjxxy909，apiserver 已从 store 干净 build 重启（非 /tmp 补丁），submit/kill/hosts 验证通过。(2) AppImage runtime 修复：nixpkgs 无 classic appimageTools（都被 GC/新版风格），下载 appimagetool（github continuous, 8.8MB）→ APPIMAGE_EXTRACT_AND_RUN=1 绕过 FUSE → 从 AppDir（AppRun+mountroot+99 store paths 闭包+desktop+icon）构建出正常 AppImage（--appimage-extract 可用）。注意：nix copy --to file:// 会建 binary cache 布局不是 nix/store 布局；cp -al 对目录 hardlink 失败、cp -a 保留只读权限难清理，用 cp -r 重建 AppDir。 | AppImage zjxxy, apiserver store build | 全绿 | ~3k |
+| 12:1x | bug-1507 merge 回归修复：恢复 getpwnam() execuser 存在性检查（+pwd.h），对齐 c091a8da。worker 全测试 21/0 通过。cerebrum 加 Do-Not-Repeat：merge 同步会静默覆盖我们的修复（bug-1490 clib.go + bug-1507 getpwnam 两个实例）——post-merge 必须核对每个 fixed bug 的 marker symbol 是否幸存（git show <merge>:<file>|grep -c vs <merge>^）。 | controller_connector.c, cerebrum.md | 修复+教训记录 | ~500 |