Draft — diagnostic instrumentation, not for review or merge.

Purpose: capture evidence for the intermittent NLT hang that has aborted the NLT stage
~13 times in 5 days across 10 unrelated PRs (#18709, #18731, #17550, #18707, #18729,
#18718, #18733, #18737, #18740, #18741). Each occurrence costs the full stage timeout and
discards all artifacts, so no build so far has produced any diagnostic data.

What hangs

test_alloc_fail_cont_create in the NLT stage (which runs mode all). dfuse stops
answering FUSE requests it has already accepted; every client using the mount then blocks
in the kernel indefinitely, and NLT's sweep loop waits forever on children that can never
finish. Reproduced twice on a 16-core cloud client; intermittent (a second cluster ran the
same sweep 9 times without hanging).

The cause is not known. The obvious explanation — dfuse's threads all tied up
servicing stalled clients — is contradicted by the only thread stacks captured so far
(from a --thread-count 2 wedge, so not necessarily the same bug): the dfuse worker was
idle in read() while the kernel held 5 queued requests, i.e. requests accepted and never
answered rather than threads busy. Getting the equivalent stacks from a
default-configuration hang is exactly what this branch is for.

What this branch adds

• A stall watchdog in the fault-injection sweep loop: if no child completes for
  NLT_FI_STALL_SECS (default 300), dump NLT thread stacks, per-child /proc state
  (wchan/syscall/State) and gdb backtraces of dfuse, the agent, the engine and the
  stalled children — then kill the wedged children so the run fails fast with artifacts
  intact instead of being aborted with none. Bounded by a wall-clock deadline, writes to a
  file as well as stdout, skips targets gdb cannot attach to, resumes any target a debugger
  left stopped, never blocks on children that outlive SIGKILL, and reports its own failure
  rather than aborting silently.
• A bounded DFuse.stop() query. Teardown currently queries the very mount that may be
  wedged with no timeout, which is why a hang consumes the whole stage rather than one test.
• Fail loudly when mode fi/all is requested but the build has no fault injection
  compiled in. Today that prints one line and exits green with the requested tests
  silently skipped.
• Make dfuse's log level and thread count settable for FI runs; the sweep pins dfuse to
  WARN, so the prime suspect in a dfuse-side wedge logs nothing at all.

NLT-repeat: 5 is set to get multiple chances at an intermittent failure per build. Skip
pragmas restrict this to builds plus NLT.

Independent of this investigation, the watchdog and the bounded teardown would convert any
future NLT hang from a lost CI run into a fast, self-documenting test failure. If they look
useful beyond the debugging, they are worth proposing separately against master.