use command_runner in wshd, + minor cleanup
lock wshd goroutine to its thread before unsharing

Only the thread the goroutine happens to be running in will be unshared. If
the Go scheduler runs from another thread, the mount namespace will be shared
again; it only affects the current thread. This would lead to the mount point
going in and out of existence through wshd running, and potentially cause the
mount changes to leak to the parent.