fix: Implement proper sandbox enforcement with corrected Landlock

[rexlunae]

Summary

Implements proper sandbox enforcement based on security findings from @aecs4u (PR #21), with a critical fix to the Landlock implementation.

Security Issues Fixed

Issue	Status
PathValidation was no-op	✅ Fixed
Background commands bypassed sandbox	✅ Fixed
Yield-mode had unsandboxed window	✅ Fixed
Landlock semantics inverted	✅ CRITICAL FIX

The Landlock Bug (Critical)

The original PR #21 implementation misunderstood Landlock's security model:

// PR #21 code - THIS IS WRONG!
// PathBeneath::new() ALLOWS access, it doesn't deny it
for deny_path in &policy.deny_read {
    ruleset.add_rule(PathBeneath::new(deny_path, AccessFs::from_read(abi)))
}

Landlock is ALLOWLIST-based: you specify what IS allowed, and the kernel denies everything else. The original code would have ALLOWED access to credentials instead of denying them!

The Fix

// Correct implementation - allowlist model
// 1. Allow system paths (read-only)
for path in ['/usr', '/lib', '/bin', '/etc', '/proc', '/sys', '/dev'] {
    ruleset.add_rule(PathBeneath::new(path, AccessFs::from_read(abi)))
}
// 2. Allow temp paths (read+write)
for path in ['/tmp', '/var/tmp'] {
    ruleset.add_rule(PathBeneath::new(path, AccessFs::from_all(abi)))
}
// 3. Allow workspace (full access)
ruleset.add_rule(PathBeneath::new(workspace, AccessFs::from_all(abi)))

// Credentials are DENIED BY OMISSION - not in allowlist = blocked by kernel

Changes

• src/sandbox.rs: Complete sandbox implementation with corrected Landlock
• docs/SANDBOX.md: Comprehensive documentation (927 lines)
• tests/sandbox_enforcement.rs: Integration tests

Sandbox Modes Supported

Mode	Platform	Strength
Landlock+Bubblewrap	Linux 5.13+	Strongest (defense-in-depth)
Landlock	Linux 5.13+	Strong (kernel-enforced)
Bubblewrap	Linux	Strong (namespace isolation)
macOS Sandbox	macOS	Strong (seatbelt)
Docker	Cross-platform	Strong (container)
Path Validation	All	Basic (software-only)

Attribution

• Security finding and initial implementation by @aecs4u
• Landlock semantics fix by Luthen (reviewed Landlock API docs)

References

• Closes Sandbox PathValidation and background command bypass #22 (Sandbox Security Vulnerabilities)
• Supersedes fix: [C1] Implement functional sandbox enforcement #21 (original PR with inverted Landlock)