fix(supervisor): tailor Landlock rights by inode type

[drew]

Summary

Fix Landlock hard_requirement sandbox startup when filesystem policy enrichment adds device files such as /dev/urandom. Rules now use inode-compatible access rights derived from the already-open path descriptor, avoiding both invalid directory-only rights on non-directories and pathname TOCTOU races.

Related Issue

Closes #2218

Changes

• Inspect each opened Landlock path with fstat before constructing its rule.
• Preserve the requested access mask for directories and intersect non-directory masks with file-compatible Landlock rights.
• Add unit coverage for directories, regular files, character devices, symlink targets, and mixed hard-requirement policies.
• Add a Docker-backed Rust E2E regression covering baseline enrichment of /dev/urandom.
• Document inode-specific Landlock rule construction and hard-requirement behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• OPENSHELL_E2E_DOCKER_TEST=landlock mise run e2e:docker
• Regression verified to fail before the fix with incompatible directory-only access-rights ... ReadDir

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[pimlock]

/ok to test ce3cc87

[pimlock]

LGTM!
Adding the e2e label, since this has a new E2E test.

[github-actions]

Label test:e2e applied for ce3cc87. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.