feat: Add Landlock access denial debug logging

[Cstewart-HC]

Summary

Add debug-level logging for Landlock FS access denials to improve troubleshooting and observability.

Context

Per Landlock kernel documentation:

Access denials shall be logged according to system and Landlock domain configurations. Log entries must contain information about the cause of the denial and the owner of the related security policy.

Currently, the Landlock implementation relies on kernel audit logging (when enabled) but provides no application-level debug logging for troubleshooting.

Implementation Notes

Where to add logging:

1. landlock.rs - Log when restrict_self() returns NotEnforced or Err

   • Include: allowed paths, rejection reason, enforcement status
   • Use tracing::debug! or tracing::warn! gated by feature flag

2. platform.rs - Log LandlockResult after apply_to_command()

   • Current: tracing::debug!(enforced = result.enforced, %result.message, "landlock")
   • Enhance: Add path list, ABI version, failure details

3. router.rs - Clarify log message to distinguish config vs. actual enforcement

   • Current: claims "landlock FS isolation" based only on fs_allow_paths.is_empty()
   • Fix: Check actual LandlockResult.enforced and platform support

Suggested approach:

• Add optional LANDLOCK_DEBUG=1 env var or --features landlock-debug
• Log denied paths with reason (e.g., execve("/bin/sh") denied: not in allowlist)
• Include sandbox ID/context in log entries
• Consider async-safe logging in pre_exec context (stderr only)

Acceptance Criteria

• Debug logging added to restrict_self() failure paths
• Enhanced logging in platform.rs with actual enforcement status
• Router log message corrected to reflect actual state
• Tests verify logging behavior (capture stderr in pre_exec)
• Documentation updated in landlock.rs module docs

Related

• PR feat: Landlock FS isolation for restricted-host sandbox (#818) #866 (Landlock FS isolation)
• Kernel docs: https://docs.kernel.org/security/landlock.html
• Greptile review confidence: 4/5 (blocked by test fix, now resolved)

Priority

P3 - Feature enhancement (not blocking merge)