fix(sandbox): name Landlock ABI in startup error

[ericcurtin]

Summary

On a kernel below Landlock ABI v3, startup failed with an opaque ruleset error. Name the required and detected ABI instead.

Related Issue

Closes #4296

Changes

• Shared require_abi check, used by the qualification probe and the baseline.
• Qualification checks the ABI before the allow/deny probe, which failed first.
• probe_availability reuses abi_version instead of a second syscall.
• One docs sentence.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy --all-targets (also perf-harness) and cargo test for openshell-sandbox, and mise run docs. capability_free_baseline_drops_each_root_entry_before_opening_the_next fails in parallel runs on main too and passes with --test-threads=1. E2E not run locally.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

/ok to test 7b0da8b

[github-actions]

Label test:e2e applied for 7b0da8b. Open Branch E2E Checks, find the run for commit 7b0da8b, and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The independent code review found no blocking issues in the shared Landlock ABI check or its earlier startup qualification. The diagnostic tests and Fern docs cover the stated change; required CI is now running on this head.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Focused sandbox startup diagnostic fix for #4296; no duplicate active PR identified.
• Docs: Updated docs/how-it-works/policies/schema.mdx; no navigation change needed.
• Checks: DCO and vouch passed. Branch Checks, Helm Lint, and Trivy Changes are running on the current head. Trivy workflow approval succeeded.
• E2E: Applied test:e2e before the authorized /ok to test command created the current-head mirror. Standard E2E is running with image and binary builds active. The label-help bot requested a rerun; GitHub refused because the run is already active. No additional attempt was queued; monitor the existing run, which picked up the label.
• Head SHA: 7b0da8b1faec3a5ab2002ff84f6070140eca8980
• Base SHA: 77c5ff6e20c98b3674616ecf35b2464f2b8e57ca
• Merge base SHA: 77c5ff6e20c98b3674616ecf35b2464f2b8e57ca
• Patch ID: 9f72d488ebc418d045ef016c0e71f98b755b9c42
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: The PR was awaiting maintainer approval when monitoring resumed; GitHub now confirms it is merged.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: 7b0da8b1faec3a5ab2002ff84f6070140eca8980
• Gator payload: 12