session-wrapper: add Linux integration tests for Landlock boundary and TOCTOU mitigation

[Rod-Persky]

Parent epic: #152

session-wrapper: add Linux integration tests for Landlock boundary and TOCTOU mitigation

Objective

Add Linux x86_64 integration/smoke coverage proving the Landlock profile is the hard execution boundary and seccomp user notification remains only the per-exec authorization/audit layer.

Breaking changes are allowed. Tests should validate the production model rather than preserving proof-of-concept behavior.

Required Test Coverage

• Session starts with a profile allowing the configured shell and /usr/bin/id.
• /usr/bin/id succeeds inside the session when inside the profile.
• An executable in a random /tmp path fails with EACCES when /tmp is writable but non-executable.
• The existing TOCTOU PoC can no longer execute a random payload from /tmp when Landlock enforce mode is active.
• python subprocess.run(["/usr/bin/id"]) works when /usr/bin/id is inside the profile.
• python subprocess.run(["/tmp/payload"]) fails with EACCES.
• Direct execution from a generic writable directory fails even when the file has executable mode bits.
• Direct execution from an explicit landlock-staging-exec directory succeeds only when TACACS+ returned that path.
• A dynamically linked shell starts with only documented loader/library dependencies allowed.
• A sudo-capable profile can run a sudoers-allowed command whose sudo binary, target command, and dependencies are inside the Landlock profile.
• A sudoers-allowed command outside the Landlock execution profile fails with EACCES.
• A non-sudo profile sets no_new_privs and cannot gain privilege through a setuid executable.
• Audit mode logs /tmp/payload as a would-block exec while allowing the session to continue.

Environment Handling

• Tests should detect Landlock support and ABI version.
• Enforce-mode tests may be skipped with a clear reason on kernels without required Landlock support, unless CI is configured to require Landlock.
• Tests requiring sudo should be isolated and skipped unless the test environment has an explicit safe sudo fixture.
• Do not require broad host privileges unless the test clearly documents why.

Acceptance Criteria

• The TOCTOU race no longer turns into arbitrary /tmp payload execution under enforce mode.
• Landlock denial surfaces as EACCES for outside-profile executable paths.
• Audit mode produces would-block findings without claiming enforcement.
• Tests are integrated into the workspace's normal test flow or documented as Linux-only smoke tests if they cannot run everywhere.