Drop gate capability sets

[chasebryan]

Summary

• drop every inheritable, permitted, effective, bounding, and ambient Linux capability before copied gate code executes
• retain user-namespace capabilities only for namespace setup, then remove them with setpriv
• enforce the same drop in the hosted sudo fallback and assert all five empty sets at runtime
• protect the boundary with exact Makefile contracts, weakening-mutation tests, policy 0.2.85, and updated security/operations documentation

Verification

• scripts/ci/check-repository
  • policy 0.2.85, zero findings
  • 287 Python tests
  • Rust debug and release: 162 library, 74 CLI unit, 32 integration, and 9 S3a conformance tests each
  • 7 Rust documentation tests
  • byte-identical two-root release builds

Remaining boundary

The kernel, namespace enforcement, passwordless namespace-setup policy, and admitted sudo, unshare, and setpriv binaries remain trusted host inputs. Hosted Required CI must exercise the fallback path before merge.