Enable user namespaces in shared CI setup (#39606)

## What changed

- Enable unprivileged user namespaces for every Linux job that uses the shared
  `setup-ci` action.
- Disable AppArmor's unprivileged user namespace restriction when that sysctl is
  available.
- Remove the duplicate setup from the two nextest workflow jobs.

GitOrigin-RevId: a5aebe0795ada435e687826134411c8b1c28bd98

.github/actions/setup-ci/action.yml

@@ -24,6 +24,15 @@ runs:
       shell: bash
       run: echo "CI_BUILD_ROOT=$HOME/.cache/codex-ci" >> "$GITHUB_ENV"
 
+    - name: Enable unprivileged user namespaces (Linux)
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        sudo sysctl -w kernel.unprivileged_userns_clone=1
+        if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        fi
+
     - name: Configure CI build paths
       id: configure_ci_build_paths
       shell: bash

.github/workflows/rust-ci-full-nextest-platform.yml

@@ -163,14 +163,6 @@ jobs:
           tool: nextest
           version: 0.9.103
 
-      - name: Enable unprivileged user namespaces (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo sysctl -w kernel.unprivileged_userns_clone=1
-          if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
-            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          fi
-
       - name: Build nextest archive
         shell: bash
         run: |
@@ -312,14 +304,6 @@ jobs:
           tool: nextest
           version: 0.9.103
 
-      - name: Enable unprivileged user namespaces (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo sysctl -w kernel.unprivileged_userns_clone=1
-          if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
-            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          fi
-
       - name: Set up remote test env (Docker)
         if: ${{ runner.os == 'Linux' && inputs.remote_env }}
         shell: bash