sometimes envfs will break on carp

on carp, /bin and /usr/bin is mounted with envfs. this is required for logging in, since loginShell in ldap is set to absolute paths in /usr/bin, /bin, and possibly something else.

sometimes envfs will break, leaving all the ssh processes in D state when it tries to get the users login shell. to fix this, you have to abort the fuse mount by running `echo 1 | sudo tee /sys/fs/fuse/connections//abort`, `umount`ing /bin and /usr/bin, and then mounting them again.

envfs could be breaking for various reasons:
- oom kills the fuse process
- some envfs bug breaks it and deadlocks everything

for now, it seems like a more resilient solution is to create a symlink for each shell in `environment.shells`. you can probably map `environment.shells` to systemd tmpfiles config that is run on each activation.

we also need to query every user's `loginShell`, `uniq`, and make sure theres symlinks for them