Bind-mount noexec for tests, keep the system alive, and improve cleanup.