Walk for setuid programs in the engine and carry an interrupted walk on (hq issue 361)

The control-node's walk takes far longer than the engine runs between
updates, so a search that starts over at every restart never completes.
The walk is the engine's own, in lexical order, so its progress is one
cursor per filesystem, kept every minute beside the engine's state and
carried on after a restart while younger than rootsearch.FreshFor. It runs
on a thread of its own at nice 19 and the idle I/O class.

cmd/mesh-host/main.go

@@ -1120,10 +1120,12 @@ func runLink(ctx context.Context, opts options) error {
 		// And which units its service managers say failed, and whose each is (novox/hq issue 315).
 		unitJudge = units.New(units.Exec{Run: apply.ExecRunner, System: builtFor})
 		// And whether an account a module put in a group has it where it runs (novox/hq ADR 0252).
-		// Its search for setuid programs runs to its end at idle priority, and the last complete one is kept
-		// beside this state, so a restart judges from it (novox/hq issue 361).
+		// Its search for setuid programs runs to its end on a thread at idle priority, keeping how far its walk
+		// got so a restart carries it on, and the last complete one beside this state, so a restart judges from
+		// it (novox/hq issue 361).
 		setuidSearch = &accounts.SetuidCache{Path: filepath.Join(filepath.Dir(opts.state), accounts.SetuidSearchFile),
-			Say: say}
+			ProgressPath: filepath.Join(filepath.Dir(opts.state), accounts.SetuidProgressFile),
+			Lower:        accounts.LowerThisThread, Say: say}
 		accountJudge = accounts.New(accounts.Exec{Run: accounts.CLocale, SearchRun: accounts.Idle, Cache: setuidSearch})
 	}