Virtual Filesystems: a tmpfs Scratch Area and a Private /proc

Two virtual-filesystem changes on this host, both of which must survive a reboot:

1. The render service runs as the user app and needs a fast scratch area in RAM. Mount a tmpfs at /srv/scratch, capped at 64 MiB, owned by app with mode 750, so the scratch directory itself belongs to app and nobody else can enter it.

2. The intern account can list every process on the box, including root's, with their full command lines. Mount /proc so that ordinary users only see their own processes.

Make both changes live now and persistent in /etc/fstab. Grading reads the live mounts, the fstab entries, and what the intern can actually see in /proc.