Walk for setuid programs in the engine and carry an interrupted walk on (hq issue 361)

The control-node's walk takes far longer than the engine runs between
updates, so a search that starts over at every restart never completes.
The walk is the engine's own, in lexical order, so its progress is one
cursor per filesystem, kept every minute beside the engine's state and
carried on after a restart while younger than rootsearch.FreshFor. It runs
on a thread of its own at nice 19 and the idle I/O class.

internal/accounts/exec.go

@@ -34,9 +34,11 @@ type Exec struct {
 	ACL      func(path string) ([]ACLEntry, error)
 	// Cache keeps the search for setuid programs between looks; nil searches on every look.
 	Cache *SetuidCache
-	// SearchRun runs the setuid search's commands (find, and the package manager it asks); nil is Run. A
-	// serving engine gives Idle, so the walk of every filesystem yields to everything else on the machine.
+	// SearchRun runs the setuid search's commands (the package manager it asks); nil is Run. A
+	// serving engine gives Idle, so they yield to everything else on the machine, as the walk does.
 	SearchRun Runner
+	// Walk carries a walk for setuid programs on; nil is the engine's own (walker). A test gives its own.
+	Walk func(ctx context.Context, p *SetuidProgress, checkpoint func()) error
 	// Now is the clock the cache is kept by; nil is the machine's.
 	Now func() time.Time
 }