shadow-core, tools: complete nix removal — phase 2 (#140)

Fully remove nix as a direct dependency of the shadow-rs workspace.

New module shadow_core::process provides process-wide POSIX wrappers
via libc for setuid/setgid/initgroups/execv/sigprocmask. These MUST
use libc (not rustix) because rustix intentionally provides only
per-thread versions, which are incorrect for setuid-root tools.

Migrations:
- hardening.rs: setrlimit → rustix::process, sigprocmask → process
  module, User::from_uid → /etc/passwd parser lookup
- pam.rs: nix::sys::termios → rustix::termios
- passwd.rs: full migration (seteuid, setuid, getuid, User lookup)
- newgrp.rs: full migration (termios, User lookup, setgid, initgroups,
  execv)
- chpasswd/chage/chfn/chsh: setuid → shadow_core::process
- lock.rs tests: fcntl_getfd → rustix::io

libc stays for: PAM FFI, crypt(3) FFI, process-wide POSIX wrappers.
nix remains only as a transitive dep of uucore (upstream).

tests/by-util/test_useradd.rs

@@ -110,7 +110,7 @@ fn test_defaults_flag() {
     // but we only care that clap parses it without error. If not root, we expect
     // exit 1 (permission denied).
     let code = run(&["useradd", "-D"]);
-    if nix::unistd::getuid().is_root() {
+    if rustix::process::getuid().is_root() {
         assert_eq!(code, 0, "-D should exit 0 when root");
     } else {
         assert_eq!(code, 1, "-D should exit 1 when not root");

tests/common/mod.rs

@@ -11,5 +11,5 @@
 ///
 /// Returns `true` if the test should be skipped.
 pub fn skip_unless_root() -> bool {
-    !nix::unistd::geteuid().is_root()
+    !rustix::process::geteuid().is_root()
 }