ci: address review — use --dist=load, per-module teardown, exclude setpriv

- Replace --dist=loadgroup (a no-op: it only groups by xdist_group marks) with
  --dist=load, and make module teardowns remove only their own SOURCE_DIR/DEST_DIR
  (never the shared worker-keyed TEST_DATA_DIR) so interleaved modules can't wipe
  each other's fixtures. Add a session-scoped cleanup of the per-worker dir.
  (loadfile grouped the whole test_features.py module onto one worker and slowed
  the full suite to 761s vs 224s with load.)
- Mark the two setpriv privilege tests with a 'setpriv' marker and run the full
  merge suite as -m "not setpriv", so the dev/main gate can't go red on the
  env-dependent /root-traversal tests regardless of the runner uid.
- Add a TLS basic test to the ci subset, add workflow_dispatch for on-demand full
  runs, and fix trailing newlines.
- Measured: smoke -m ci = 28 passed/39s; full -n4 = 280 passed/11 skipped/1 xpassed
  in 224s (was 860s serial).

pytest.ini

@@ -1,4 +1,7 @@
 [pytest]
 ; Fast integration subset run on every pull request (see .gitea/workflows/ci.yaml).
 markers =
-    ci: fast, representative integration tests run on the PR CI gate
+    ci: fast, representative integration tests run on the PR CI gate
+    setpriv: privilege-dependent tests (drop to an unprivileged user); excluded
+        from CI because their result depends on the runner/container uid and the
+        host mount permissions, but run locally as root