feat(shell): wire the Landlock fs_write L3 boundary into the engine (#35)

[hartsock]

Part of #35 — wires the Landlock fs_write L3 boundary into the engine, turning the shell from purely-advisory into actually kernel-confined on Linux. Per ADR 0005 (L3 is the boundary) / ADR 0006 (per-OS backends). Left open for review — please test on your Mac first.

What changed

• OsSpawner now applies the OS sandbox: when an L3 backend will actually confine the run, it executes the pipeline on a dedicated thread that calls best_available_sandbox().apply(caveats) before spawning, so the kernel ruleset is inherited by every child. (restrict_self is per-thread/irreversible/inherited — hence the throwaway thread, never the shared blocking pool.)
• The Spawner seam gains the effective &Caveats; the mock ignores it.
• intended_sandbox_kind() computes the kind that will truly be enforced (Landlock iff a capable Linux build has fs_write restricted, else None) and invoke reports exactly that — never overclaiming (I9 / ADR 0006 D3).
• apply() stays fail-closed (ADR 0006 D4): if the kernel won't enforce, the run errors rather than proceeding unconfined.

This closes the ADR-0001 gap on the fs_write axis: a permitted program's own out-of-scope write (e.g. find -exec/touch writing outside fs_write) is now denied by the kernel — which L2 cannot see once the child has spawned.

Apple Silicon / macOS

All Landlock code is cfg(all(target_os = "linux", feature = "linux-landlock")). On macOS the engine builds clean and runs advisory with honest SandboxKind::None. The real macOS boundary is Seatbelt (#50) — it must be authored/verified on a Mac (can't be built/tested from the Linux CI box). Design: ADR 0006.

How to test on the MacBook (Apple Silicon)

just check                              # fmt + clippy + tests, all green
cargo test -p agent-bridle-tool-shell   # the Landlock test is cfg'd out on macOS

Expected: everything passes; the engine works; any run reports "sandbox_kind": "none" (honest — no Seatbelt yet). Nothing Landlock-specific compiles. This PR's job on macOS is "don't break Apple Silicon + keep the seam ready for #50."

On Linux (what CI exercises)

New integration test real_landlock_confines_a_spawned_childs_own_write (self-skips if the kernel lacks Landlock): touch within fs_write succeeds and reports sandbox_kind: landlock; touch outside is kernel-denied and the file is not created. Verified locally on a 6.8 kernel.

Scope / follow-ups (still on #35 and friends)

• fs_read + execute axes (need a loader/system-path base allow-list) and net (netns / Landlock-net) — ADR 0004 D2: un-stub gate — no confinement regression below the fail-closed stub #31.
• macOS Seatbelt shell L3: macOS (Seatbelt) sandbox backend for the per-OS toggle #50, Windows shell L3: Windows (job object / restricted token) sandbox backend #51. os-sandbox meta-feature / per-backend SandboxKind variants per ADR 0006.

Test plan

just check green (fmt + clippy --all-features & --no-default-features + workspace tests; the --all-features run executed the real Landlock enforcement on a Landlock-capable kernel). All prior tests pass.

🤖 Generated with Claude Code