feat(sandbox): seccomp-notify network enforcement for Platform mode

Add kernel-level network syscall interception using SECCOMP_RET_USER_NOTIF.

DnsPinnedAllowlist: DNS pinning at sandbox creation, frozen IPs.
BPF filter: connect, sendto, sendmsg, recvfrom, recvmsg, bind with
AUDIT_ARCH validation. Non-native ABI routed to NOTIFY for supervisor
inspection. compile_error on unsupported architectures.

Syscall wrappers: notification fd ioctls, pidfd_open/pidfd_getfd
(TOCTOU-safe), verify_socket_fd, read_exact, sockaddr parser,
deny/allow_connect helpers.

Ref: NVIDIA#899
Signed-off-by: Ladislav Smola <lsmola@redhat.com>

Author: Ladas

crates/openshell-sandbox/src/lib.rs

@@ -23,6 +23,7 @@ pub mod procfs;
 mod provider_credentials;
 pub mod proxy;
 mod sandbox;
+pub mod seccomp_notify;
 mod secrets;
 mod skills;
 mod ssh;