Sync upstream main into fix/nsjail-no-cgroup-clone (2026-10-12)

[busla]

Updates fix/nsjail-no-cgroup-clone to the resolved upstream LibreChat-AI/code-interpreter main snapshot at c854ab5f37c656e88e6e4ad8b834cc8d17659151 (75 upstream commits beyond the previous sync).

Conflict resolutions preserve both sides:

• The runner entrypoint uses upstream's supervisor policy and the fork's absolute Bun path; it still removes clone_newcgroup when cgroups are disabled.
• The MinIO default AWS credential chain is retained in upstream's extracted service/src/minio-client.ts module.
• Redis cluster-safe BullMQ prefixes and tagged execution keys are kept with upstream's reconnect behavior.
• The Docker build keeps upstream's sandbox IPC stage and the fork's Pandoc/WeasyPrint document tooling.

The 9 fork-specific commits were replayed on upstream main for the merge result. This sync branch applies that resolved tree as a snapshot commit on top of the fork branch. The earlier code sync PR #4 was already merged, so there is no open older sync PR to close.

CI note: the first Deployment Config Tests run failed with Permission denied on tests/kvm_guest_dns.sh. The GitHub file write created that shell script without its executable mode, so the latest commit updates the workflow to run it through bash. The updated head was pushed; follow-up checks are not yet visible.

Verification: current upstream/fork tips and the merge result were checked locally; no conflict markers remain. Tests were not run locally.