feat(core): Landlock fs_read axis with loader/system base allow-list (#31)

[hartsock]

Part of #31 (checklist item 1) — adds the Landlock fs_read axis with a loader/system base allow-list, closing the read half of the ADR-0001 L3 gap. Open for review (risk:high), like #53.

What

LandlockSandbox::apply now governs reads as well as writes:

• When fs_read is restricted (Only), the ruleset read-allows the granted read roots plus BASE_READ_PATHS (the dynamic linker, shared libs, /etc/ld.so.cache, locale, name-resolution config, /proc/self, /dev essentials) and denies everything else.
• Reads use ReadFile | ReadDir only — Execute is left ungoverned this increment so libraries can be mmap-exec'd without an execute allow-list (the exec axis is a follow-up).
• When fs_read is All, reads stay ambient (nothing to confine).
• New scope_roots() helper shares existing-path resolution across both axes; apply() stays fail-closed (ADR 0006 D4).

Why

A permitted program can no longer read user data outside fs_read — e.g. grep -f /etc/shadow is denied because /etc is not granted wholesale (only /etc/ld.so.cache as a single file) — while still loading libc and running.

Testing (Linux + linux-landlock, self-skips without Landlock)

• fs_read in-scope read succeeds; out-of-scope is EACCES (kernel).
• A real dynamically-linked binary (cat) still loads under read confinement and reads the in-scope file, but is denied the out-of-scope one — proves the base list lets binaries start and that reads are really confined.
• fs_read: All leaves reads ambient.
• All prior write-axis tests pass. Verified on a 6.8 kernel; just check green.

Apple Silicon / macOS

Core change behind cfg(all(target_os="linux", feature="linux-landlock")) — macOS builds unaffected (honest None). No engine change here; composes with #53.

Scope / follow-ups (still #31)

• exec axis — block find -exec curl / awk system() via exec-Caveat path resolution (only granted program paths + loader/libs executable).
• net egress — netns / Landlock-net (≥6.7) / seccomp.
• Base list is tuned for glibc/FHS (the CI target); musl/Nix may need more entries (non-existent paths are skipped, so harmless).
• Composes with feat(shell): wire the Landlock fs_write L3 boundary into the engine (#35) #53: once both land, restricting fs_read confines the spawned interior's reads. A tiny follow-up will make intended_sandbox_kind (in feat(shell): wire the Landlock fs_write L3 boundary into the engine (#35) #53) also trigger on fs_read: Only (today it triggers on fs_write: Only).

Test plan

just check green (fmt + clippy --all-features & --no-default-features + workspace tests; the --all-features run executed the new read-axis enforcement on a Landlock-capable kernel).

🤖 Generated with Claude Code