Confine gate filesystem access

[chasebryan]

Summary

• hide /home in copied-command mount namespaces and expose the selected Rust toolchain through a read-only bind
• build a protected dependency-free Landlock launcher from the checked capture and require ABI 3 or newer
• allow file contents only from admitted system/toolchain roots and writes only in the two temporary gate roots and four required devices
• close every inherited descriptor above standard error before copied code executes
• isolate HOME, TMPDIR, and PATH, and assert that the original checkout is unreadable at runtime
• protect the full setup with exact Makefile contracts, weakening mutations, adversarial launcher tests, policy 0.2.86, and explicit residual-risk documentation

Verification

• scripts/ci/check-repository
  • policy 0.2.86, zero findings
  • 288 Python tests, including Landlock read/write/symlink escape and inherited-descriptor denial
  • Rust debug and release: 162 library, 74 CLI unit, 32 integration, and 9 S3a conformance tests each
  • 7 Rust documentation tests
  • byte-identical two-root release builds

Remaining boundary

Landlock intentionally permits directory listing for sysroot discovery and does not mediate every metadata operation. Standard descriptors remain caller-provided. The system C compiler, launcher source, kernel, mount/namespace implementation, admitted system trees, and hosted passwordless namespace policy remain trusted inputs. Hosted Required CI must exercise Landlock through the privileged namespace fallback before merge.