seccomp: require child memory peek in the availability probe

With Yama ptrace_scope=2 and no CAP_SYS_PTRACE, process_vm_readv and
/proc/<pid>/mem both fail, so sc_decide cannot read path strings and every
workspace write gets EACCES. The old probe only checked the USER_NOTIF
round trip, so CST_SANDBOX=seccomp and the forced-seccomp test pass looked
available and then failed on the first write.

sc_can_peek() forks a child, places a marker on its stack, and retries the
same sc_peek path. sc_probe() now needs that too, so those hosts fall back
to none (or keep landlock) instead of a silent deny-all sandbox.

tests/test_sandbox.c

@@ -367,7 +367,19 @@ int main(void) {
       printf("test_sandbox: forced seccomp\n");
       test_confined(CST_SANDBOX_SECCOMP);
     } else {
-      printf("test_sandbox: seccomp not available here\n");
+      FILE *yf = fopen("/proc/sys/kernel/yama/ptrace_scope", "r");
+      int yama = -1;
+      if (yf) {
+        if (fscanf(yf, "%d", &yama) != 1)
+          yama = -1;
+        fclose(yf);
+      }
+      if (yama >= 2)
+        printf("test_sandbox: seccomp not available here "
+               "(yama.ptrace_scope=%d; cannot peek child memory)\n",
+               yama);
+      else
+        printf("test_sandbox: seccomp not available here\n");
     }
     if (was)
       setenv("CST_SANDBOX", saved, 1);