)

AWS Lambda's Firecracker seccomp profile blocks prctl(PR_SET_PDEATHSIG),
causing every subprocess spawn to fail with "Operation not permitted"
(EPERM). This happens even with --dangerously-bypass-approvals-and-sandbox
because the prctl call is in the process spawner (spawn.rs, pipe.rs,
sleep-inhibitor), not in the sandbox layer.

The parent-death signal is a best-effort cleanup mechanism — when it
fails with EPERM, we gracefully continue instead of propagating the
error. The existing kill_on_drop(true) on tokio::process::Command
provides an alternative cleanup path.

Patched call sites:
- codex-rs/utils/pty/src/process_group.rs (core spawn + pipe paths)
- codex-rs/linux-sandbox/src/proxy_routing.rs (network proxy)
- codex-rs/utils/sleep-inhibitor/src/linux_inhibitor.rs

Also adds a GitHub Actions workflow (lambda-build.yml) to produce a
statically linked aarch64-unknown-linux-musl binary for Lambda Layers.

Ref: #4725

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

- Add UBSan wrapper step (required for musl cross-compilation)
- Add libubsan1 dependency
- Add all sanitizer flag clearing (matching official release workflow)
- Trigger on main branch pushes instead of feature branch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>