GeezerVison

This PR is stale because it has been open for 90 days with no activity.

Following up after the inactivity reminder: I rechecked this against gh-115159 and the original regression/fix in gh-114887 / gh-114893. The implementation follows the combined approach described on the issue: explicitly opt-in netraw, plus unprivileged FakeRawSocket coverage for asyncio.

Revalidated commit 89c6fd977f82861fdf28cc13781a6b8e23ae0188 with a freshly rebuilt debug interpreter on Linux (WSL2):

• Without netraw, the real socket creation test skips as intended; the asyncio fallback passes on epoll, poll, and select (3 cases).
• With explicit -u netraw, real raw socket creation and all three asyncio loop cases pass (4 cases). These ran as UID 1000 in a temporary network namespace with only loopback and CAP_NET_RAW; no persistent permission changes were needed.
• Both fallback and real-raw targeted tests also pass -R 3:3 --fail-env-changed checks.
• The resource argument parsing test passes. A targeted -u all run also confirms that real raw socket creation still skips while all three fallback cases pass.
• As a negative control, temporarily restoring the pre-fix sock.type != SOCK_DGRAM check in memory makes all three fallback cases fail with the expected ValueError. The checked-out source was not modified for this check.

Targeted reproduction commands (run the explicit netraw command only in an environment allowed to create raw sockets):

./python -I -m test test_asyncio.test_events -m '*test_create_datagram_endpoint_sock_raw*' --fail-env-changed
./python -I -m test -u netraw test_socket -m '*test_create_raw_socket*' --fail-env-changed
./python -I -m test -u netraw test_asyncio.test_events -m '*test_create_datagram_endpoint_sock_raw*' --fail-env-changed

Full validation: ./python -I -m test -j4 test_regrtest test_socket test_asyncio succeeds (3,694 tests, 94 skipped; 35 test files OK, 2 Windows-only files skipped).

@ncoghlan, if you have time, could you review whether this is a suitable implementation of the combined approach you proposed? This keeps privileged raw-socket coverage opt-in; configuring CI/buildbots to opt in remains outside this PR. I have not locally validated the actual raw path on Windows or macOS.

This follow-up investigation and validation were prepared with AI assistance. No code changes were made in this follow-up.