Walk for setuid programs in the engine and carry an interrupted walk on (hq issue 361)

The control-node's walk takes far longer than the engine runs between
updates, so a search that starts over at every restart never completes.
The walk is the engine's own, in lexical order, so its progress is one
cursor per filesystem, kept every minute beside the engine's state and
carried on after a restart while younger than rootsearch.FreshFor. It runs
on a thread of its own at nice 19 and the idle I/O class.

rootsearch/rootsearch.go

@@ -13,7 +13,8 @@
 // **And why no bound on one search.** On a machine with millions of files the walk takes longer than any bound
 // worth stating (the control-node's did not finish in fifteen minutes, issue 361), and a search ended early
 // judges nothing, so a bound made such a machine never judged. The search runs to its end at idle priority,
-// once at a time; an incomplete search is never "free".
+// once at a time, keeping how far its walk got every minute so an engine restarted midway carries it on; an
+// incomplete search is never "free". A walk resumed more than FreshFor after it started is begun again.
 package rootsearch
 
 import "time"