t27c seal: test record holds the temp dir's pid, and a missing zig is sealed silently #7243

Problem

t27c seal --save writes two facts about the sealing machine into the seal, as if they were facts about the spec.

1. The test record names a temp directory with a process id. bootstrap/src/test_report.rs:441 builds the working directory as t27c-test-report-<stem>-<pid>. The first line of zig's error goes into tests.blocked as is:
   "blocked": "does not compile: /tmp/t27c-test-report-base64-1848105/spec.zig:17:56: error: ..."
   Two reseals of the same spec with the same binary therefore write different files. Measured 2026-10-07 on the Railway lab: 58 seal files resealed twice from the same tree, with the same --save and the same build of 403b27f. All 58 differed in sealed_at, and 48 also differed in the /tmp/...-<pid>/ part of blocked. Nothing else differed. 512 seals on master (93302d1) carry such a path today.
2. A missing zig is sealed silently. With /opt/zig left off PATH, seal --save exited 0 on all 28 specs and wrote "blocked": "zig not on PATH" into each test record. That is a statement about the machine, not about the spec. A bulk reseal on a host without zig quietly replaces every real test result.

Expected

• blocked holds the error with the working-directory prefix removed (spec.zig:17:56: error: ...). A reseal of an unchanged spec with an unchanged binary then changes only sealed_at.
• seal --save refuses, or at least warns on stderr and exits non-zero, when the test record would be "zig not on PATH". --force can still allow it.

Acceptance criteria

• A unit test in test_report.rs: seal_record of a blocked report whose error carries /tmp/t27c-test-report-x-123/spec.zig:1:2: error: e stores spec.zig:1:2: error: e.
• Resealing the same spec twice in a row gives files that differ only in sealed_at (shown on two specs: one blocked, one passing).
• PATH=/usr/bin:/bin t27c seal --save <spec> exits non-zero without --force.
• The 512 existing paths go away in the next reseal of each spec; no bulk reseal is needed for this issue.

Found while resealing the first slice of #7191 (two reseals of the same tree differed in exactly these places). Foreign Rust: bootstrap/src/test_report.rs and main.rs (label owner-approved-foreign, standing owner rule).