Language-idiom round: one-buffer shell quoting, AfterFunc drain, synctest suite

[CMGS]

Language-idiom round across the Go and Rust trees. Scan provenance: the
standalone modernize tool (all 23 analyzers) reports zero findings on every
module and clippy already denies unwrap_used — this round only carries what
those gates structurally cannot see. Production behavior is unchanged.

silkd (Rust)

• shell_quote → shell_quote_into: session command lines are built in one
  buffer instead of N quoted temporaries + a Vec + join per exec; the
  Table::create cd/export init lines fold the same way. Quoting output is
  byte-identical, now pinned by a unit case table (plain, space, embedded
  quote, empty).
• find.rs: the one remaining .map(...).unwrap_or(false) becomes
  is_some_and, matching the file's existing idiom.
• Gate: cargo fmt --check, clippy --all-targets, and the full test suite
  (17 lib + 78 integration tests) run clean on Linux (rust 1.97.1 container on
  the testbed; cargo is unavailable on the dev host).

sandboxd (Go)

• main.go: the shutdown-drain goroutine becomes context.AfterFunc,
  matching the preview-server shutdown a few lines above. Drained-channel
  semantics preserved.
• pool tests: 40 of the 43 timing-dependent tests now run under
  testing/synctest (stable since Go 1.25), so their 5ms–3s polling loops
  resolve on the bubble's virtual clock — deterministic timing, no more
  CI-tail latency on the 2–3s worst-case loops (0.00s under isolation;
  whole-package wall clock ~2.9s→1.9s). The three exceptions deliberately
  stall a goroutine while holding a real sync.Mutex, which synctest never
  treats as durably blocked (the bubble would deadlock); each carries a WHY
  comment with that root cause. egress_test.go is untouched — it arms real
  Unix-socket listeners.

Considered and rejected (recorded so the next scan doesn't re-walk them)

• os.Root for data_dir/store/marker paths: every join is either pinned by
  an ID regex at the API boundary or an operator-configured path — ceremony,
  not safety.
• unique.Make interning of pool keys/tenants: Go string assignment doesn't
  copy backing bytes; the intern table would add lock indirection to the
  warm-claim path for nothing.
• boot/init micro-allocations (trim/format churn in 2ms poll loops):
  sleep-dominated by three orders of magnitude.
• mesh candidate iterators: placement jitter needs random index access; the
  materialized slices stay.

Gates

• Go: build, -race across all 14 packages, dual-GOOS golangci-lint
  (cache-cleaned) 0 issues, gofmt/gofumpt/goimports clean, asl dual-GOOS zero
  findings.
• Rust: Linux container gate as above; boot/init untouched.
• Hot paths untouched: no production change lands on the warm-claim or wire
  data path; the silkd change trims allocations on the exec verb only.