ReadMsgUnix MSG_CTRUNC cleanup

Trap: returning immediately on MSG_CTRUNC looks safest, but Linux may install the descriptors that fit while closing only excess descriptors; repeated malformed START frames can exhaust the root process fd table. Fix: use MSG_CMSG_CLOEXEC, parse and record received descriptors before handling truncation, enforce the fd ceiling, and close every accumulated descriptor on every rejection path.