client: close namespace file handle and defensively lazy unmount

[mismithhisler]

Description

Nomad was holding open the namespace file handle, which would eventually get cleaned up by garbage collection. In batch jobs that ran very quickly, it was possible the leaked file handle was still open, and causing errors when attempting to unmount the namespace.

In addition to closing the file handle, we can use a MNT_DETACH flag when unmounting to ensure that in the event a namespace file handle is left open, the namespace is still unmounted eventually and no resources are leaked.

Fixes GH#25610

Testing & Reproduction steps

See GH#25610 for reproduction steps. In addition, you can see Nomad accessing the namespace file via shimming in an exec.Command("fuser", -v, nsPath) right before unmounting. This can be reproduced in Podman and exec2.

Links

Contributor Checklist

• Changelog Entry If this PR changes user-facing behavior, please generate and add a
  changelog entry using the make cl command.
• Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
  ensure regressions will be caught.
• Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
  and job configuration, please update the Nomad website documentation to reflect this. Refer to
  the website README for docs guidelines. Please also consider whether the
  change requires notes within the upgrade guide.

Reviewer Checklist

• Backport Labels Please add the correct backport labels as described by the internal
  backporting document.
• Commit Type Ensure the correct merge method is selected which should be "squash and merge"
  in the majority of situations. The main exceptions are long-lived feature branches or merges where
  history should be preserved.
• Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
  within the public repository.

[tgross]

LGTM! Nice work on this

[tgross]

LGTM!

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.