Package portable Linux runtime and verify Google CPU search

tools/embeddinggemma2/test_linux_loader_smoke.py

@@ -0,0 +1,28 @@
+"""Namespace guards must reject unsafe handoffs before any mount operation."""
+import argparse
+import unittest
+from unittest.mock import patch
+
+import linux_loader_smoke
+
+
+class NamespaceGuardTests(unittest.TestCase):
+    def test_same_namespace_refuses_mount_before_runtime_access(self):
+        args = argparse.Namespace(outer_pid=123, outer_namespace=42)
+        with patch.object(linux_loader_smoke, "namespace", return_value=42), \
+                patch.object(linux_loader_smoke.subprocess, "run") as run:
+            with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
+                linux_loader_smoke.isolated_check(args, {"mount": "mount"})
+            run.assert_not_called()
+
+    def test_changed_outer_namespace_refuses_mount(self):
+        args = argparse.Namespace(outer_pid=123, outer_namespace=42)
+        with patch.object(linux_loader_smoke, "namespace", return_value=43), \
+                patch.object(linux_loader_smoke.subprocess, "run") as run:
+            with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
+                linux_loader_smoke.isolated_check(args, {"mount": "mount"})
+            run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()