crash on app seg ref w/ early injection in non-CI build

In the nightly, the vps build is non-CLIENT_INTERFACE, and it has an app
crash (which is propagated out via SYS_kill):

```
interp: start_pc = 0xf77400ea
check_thread_vm_area: pc = 0xf77400ea
prepend_entry_to_fraglist: putting fragment @0xf77400ea (shared) on vmarea 0xf773d000-0xf775e000
0xf77400ea 8b 93 2c ff ff ff mov 0xffffff2c(%ebx)[4byte] -> %edx
0xf77400f0 8b 02 mov (%edx)[4byte] -> %eax
0xf77400f2 30 c0 xor %al %al -> %al
0xf77400f4 65 a3 14 00 00 00 mov %eax -> %gs:0x14[4byte]
0xf77400fa 8b b3 08 ff ff ff mov 0xffffff08(%ebx)[4byte] -> %esi
0xf7740100 85 f6 test %esi %esi
0xf7740102 74 0f jz $0xf7740113
end_pc = 0xf7740104

Fragment 1062, tag 0xf77400ea, flags 0x9000630, shared, size 57:
0xef77dd44 8b 93 2c ff ff ff mov 0xffffff2c(%ebx)[4byte] -> %edx
0xef77dd4a 8b 02 mov (%edx)[4byte] -> %eax
0xef77dd4c 30 c0 xor %al %al -> %al
0xef77dd4e 64 89 0d 08 00 00 00 mov %ecx -> %fs:0x08[4byte]
0xef77dd55 64 8b 0d 44 00 00 00 mov %fs:0x44[4byte] -> %ecx
0xef77dd5c 89 04 0d 14 00 00 00 mov %eax -> 0x14(,%ecx)[4byte]
0xef77dd63 64 8b 0d 08 00 00 00 mov %fs:0x08[4byte] -> %ecx
0xef77dd6a 8b b3 08 ff ff ff mov 0xffffff08(%ebx)[4byte] -> %esi
0xef77dd70 85 f6 test %esi %esi
0xef77dd72 0f 84 9d a6 01 00 jz $0xef798415
0xef77dd78 e9 98 a6 01 00 jmp $0xef798415

(gdb) info reg
eax 0x8add100 145608960
ecx 0x0 0
```

That's ld.so. So the app %gs value is 0. Something is not set up right.

vps build:

```
TLS app lib base =0x00000000
TLS app alt base =0x00000000
TLS priv lib base =0x00000000
TLS priv alt base =0xef79d000
TLS DynamoRIO base=0xef79d000
tls_get_fs_gs_segment_base selector 0 index 0 ldt 0
post-TLS-setup, cur gs base is 0x00000000
tls_get_fs_gs_segment_base selector 73 index 14 ldt 0
get_thread_area 14 => ef79d000
post-TLS-setup, cur fs base is 0xef79d000
```

CI build:

```
TLS app lib base =0x00000000
TLS app alt base =0x00000000
TLS priv lib base =0xef74ab70
TLS priv alt base =0xef745000
TLS DynamoRIO base=0xef745000
tls_get_fs_gs_segment_base selector 63 index 12 ldt 0
get_thread_area 12 => ef74ab70
post-TLS-setup, cur gs base is 0xef74ab70
tls_get_fs_gs_segment_base selector 73 index 14 ldt 0
get_thread_area 14 => ef745000
post-TLS-setup, cur fs base is 0xef745000
```

Start by tracing the TLS setup path around tls_get_fs_gs_segment_base and compare the VPS non-CI and CI build logs. Investigate why the app %gs selector/base is zero in the VPS case, then validate the behavior with the affected nightly VPS build and confirm the crash no longer occurs.

Written by the indexing model from the issue text.