shell L3: macOS (Seatbelt) sandbox backend for the per-OS toggle

[hartsock]

The L3 backend for macOS / Apple Silicon (per the per-OS-family design — ADR 0006). The maintainer runs on Apple Silicon, so this is the backend that actually confines on their machine; Landlock (#35) is Linux-only and falls back to honest SandboxKind::None on macOS.

Plan (per ADR 0006)

• A macos-seatbelt cargo feature with its dep/impl under [target.'cfg(target_os = "macos")'.dependencies] (inert off macOS).
• A SeatbeltSandbox implementing the Sandbox trait, selected by best_available_sandbox()'s cfg(all(target_os="macos", feature="macos-seatbelt")) arm; else NoopSandbox.
• A SandboxKind::Seatbelt variant (honest reporting, I9).
• Mechanism options to evaluate: sandbox-exec -p <SBPL profile> wrapping the spawned process (deprecated-but-functional, no FFI), or sandbox_init/SBPL via FFI. Generate a profile from the effective Caveats (deny file-write outside fs_write, deny network for net: none, allow the loader/system paths).
• Confine the spawned program's interior the way Landlock does on Linux: find -exec curl, grep -f /etc/shadow blocked.

Note

Must be authored and verified on a Mac — it cannot be compiled or tested from the Linux CI box. Keep it cfg-gated so non-macOS builds are unaffected. Until it lands, macOS runs the engine advisory (sandbox_kind: none, honest).

[hartsock]

Design recorded in ADR 0006 (per-OS L3 backends + engines as opt-in cargo features), merged in #52 (2320011f1c13b56e341ea8e1c0c93f6efbaef2d4): docs/adr/0006-per-os-l3-backends-and-optional-engines.md.