Avoid text-file-busy failures in the generated webhook fixture #5331

🤖 Generated by the Agentic Engineer

Problem and impact

The parallel Go helper suite can fail before its mutation-enabled webhook fixture starts. This evicts an unrelated candidate from the production merge queue, even though the helper's actual assertions never ran.

Evidence

Platform #5315 was removed with failed_checks at 11:06:33 UTC on 25 October 2026. In the complete-suite job, TestMutationEnabledImageVerificationPolicyRequiresBothWebhooks/missing_mutating_webhook failed with fork/exec .../.refresh-flux-ghcr-auth-test-...: text file busy.

The fixture writes a temporary Bash script, closes it and directly executes that new file while other tests launch processes in parallel. This matches the descriptor inheritance race described in Go issue 22315; closing the parent's writer does not prove another fork has dropped its inherited writer.

Expected outcome

The generated Bash fixture starts reliably under the existing process supervision and still exercises both the refusing and successful webhook paths.

Acceptance criteria

• Run the generated script through the existing Bash interpreter without directly executing the newly written file.
• Keep the missing-webhook refusal, both-webhooks success, deadlines and child cleanup checks intact.
• Both existing mutation-enabled subtests and the complete affected package pass.
• Record current-head hosted Linux execution before promotion; local macOS success alone does not verify the Linux launch failure.

Size: small. Part of #4979. The later queue failure in run 40187650600 is a separate public-evidence HTTP 403 and is outside this launcher fix.