Linux: call statx through syscall(2) so release builds link

benchmarks/aft-search/slice-descriptors/land-linux-statx-syscall.json

@@ -0,0 +1,12 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "harness-goldens"
+  ],
+  "slices": [
+    "linux-statx-syscall"
+  ],
+  "note": "Linux release link fix: statx through syscall(2). No changed path matches RANKING_FENCE_PREFIXES."
+}

crates/aft/src/bash_background/persistence.rs

@@ -1722,8 +1722,14 @@ fn file_mount_identity(file: &File) -> io::Result<(u64, Vec<u8>)> {
     #[cfg(target_os = "linux")]
     {
         let mut stat = std::mem::MaybeUninit::<libc::statx>::zeroed();
+        // Call statx through syscall(2), not glibc's wrapper: the wrapper only
+        // exists from glibc 2.28, and the Linux release binary is linked
+        // against an older glibc so it runs on older distributions. A kernel
+        // without statx fails with ENOSYS, which refuses the repair like any
+        // other unverifiable mount boundary.
         if unsafe {
-            libc::statx(
+            libc::syscall(
+                libc::SYS_statx,
                 file.as_raw_fd(),
                 c"".as_ptr(),
                 libc::AT_EMPTY_PATH | libc::AT_SYMLINK_NOFOLLOW,

crates/aft/src/callgraph_store/mod.rs

@@ -32679,7 +32679,10 @@ mod bounded_build_breaker_tests {
     const SPECIMEN_CHILD_SIGNAL: &str = "AFT_SPECIMEN_CHILD_SIGNAL";
 
     fn wait_for_child_barrier(path: &Path) {
-        let deadline = Instant::now() + Duration::from_secs(10);
+        // The child is a fresh test-binary process that builds a call graph
+        // before it reaches the barrier; a loaded macOS runner needed more
+        // than 10 s for that.
+        let deadline = Instant::now() + Duration::from_secs(60);
         while !path.exists() {
             assert!(
                 Instant::now() < deadline,