Check file and directory access for explicit container identities

[decryptus]

A read-write mount does not guarantee access for an application identity. Add opt-in fs_readable, fs_writable and fs_executable resources to existing path groups, with explicit numeric UID/GID and expected groups.

Use an isolated Python 3 standard-library probe inside the selected container. os.access delegates to kernel access checks; real/effective/saved/filesystem IDs must agree, actual group membership must match, and effective/permitted capabilities must be zero. Missing utilities/paths, mismatches or malformed responses fail collection instead of reporting healthy access. Cache by path AND identity.

Real setfacl tests exposed that BusyBox shell test ignores the named ACL entries in our fixture. The implementation now explicitly requires python3 in the target container; it never installs anything there. No agent-side dependency, permissions modification or file creation is added. CLI/rule validation, Prometheus gauges and documentation cover ACL masks, inheritance, same-path group semantics and limitations for SELinux/AppArmor/NFSv4/SMB.

Validation: local 288-test suite (15 real-Docker cases delegated to CI), 20 workflow/example checks and strict Sphinx build. Docker integration fixtures cover named users/groups, masks, defaults, directory traversal, files, symlinks, mismatched groups and privileged probes. No release version changes.

Final verification on 80eb1fd: 289 tests collected; all 15 Docker integration tests passed separately (2 POSIX ACL, 2 OOM/PID, 11 existing integration cases). Both Python versions, image/package builds, browser and documentation checks pass. A regression test now verifies closing both the Docker SocketIO wrapper and underlying socket; the real ACL run no longer emits the observed unclosed-socket warnings.