fix(sandbox): resolve Landlock handle_access ownership move

handle_access() takes self by value, consuming the Ruleset. In the
previous code, the match arms meant that on Err the original ruleset
was moved into the match and unavailable for create(). Fix by letting
handle_access propagate via ? (BestEffort compat level ensures it
succeeds on all kernel versions, silently degrading on ABI < v4).

Replace tcp_handled bool with direct NetworkMode::Platform check
since handle_access now always succeeds in Platform mode.

Signed-off-by: Ladislav Smola <lsmola@redhat.com>

Author: Ladas

crates/openshell-sandbox/src/sandbox/linux/landlock.rs

@@ -185,23 +185,13 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
             .into_diagnostic()?;
 
         // Platform mode: declare intent to handle TCP connect access.
-        // Caught independently -- filesystem sandboxing continues even if
-        // TCP port restriction is unavailable (ABI < v4).
-        let mut tcp_handled = false;
+        // The BestEffort compat level silently ignores this on kernels
+        // without ABI v4, so handle_access succeeds but the restriction
+        // has no effect. The add_rule fallback below detects this.
         if matches!(policy.network.mode, NetworkMode::Platform) {
-            match ruleset.handle_access(AccessNet::ConnectTcp) {
-                Ok(r) => {
-                    ruleset = r;
-                    tcp_handled = true;
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        error = %e,
-                        "Landlock handle_access(ConnectTcp) failed (ABI v4 required). \
-                         TCP port restriction will not be applied."
-                    );
-                }
-            }
+            ruleset = ruleset
+                .handle_access(AccessNet::ConnectTcp)
+                .into_diagnostic()?;
         }
 
         let mut ruleset = ruleset.create().into_diagnostic()?;
@@ -227,7 +217,7 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
             }
         }
 
-        if tcp_handled {
+        if matches!(policy.network.mode, NetworkMode::Platform) {
             let proxy_port = policy
                 .network
                 .proxy