Sandbox: seccomp user-notify fallback for Termux and kernels without Landlock

- Child installs a seccomp filter with a listener; a supervisor thread
  resolves the path of write-type syscalls (cwd, dirfd, .., symlinks,
  /proc/self, /dev/stdout, both ends of rename/link) and answers
  CONTINUE or EACCES; IPv4/IPv6 sockets are refused
- Probe order Landlock -> seccomp -> none, checked in a throwaway child;
  CST_SANDBOX=landlock|seccomp|off
- curl connect failures count as sandbox refusals
- test_sandbox runs the detected sandbox and forced seccomp, with escape,
  symlink, rename, link, chmod, stdout, ENOENT, background and network cases
- Docs: platform matrix, limits (not a security boundary, Yama and
  background jobs)

docs/env_openai.md

@@ -78,7 +78,7 @@ export OPENAI_MODEL='your-model'
 | `CST_MODELS` | `/model` 可选列表，`:` 或 `,` 分隔 |
 | `CST_AUTO_APPROVE=1` | 自动允许 shell/写文件（= `--approval yolo`；headless 默认开启） |
 | `CST_APPROVAL` | 审批模式 `ask` / `auto`（默认）/ `yolo` |
-| `CST_SANDBOX=off` | 关闭 run_shell 沙箱（Landlock / macOS sandbox），`auto` 回落到只读白名单 |
+| `CST_SANDBOX=off` | 关闭 run_shell 沙箱（Landlock / seccomp / macOS sandbox），`auto` 回落到只读白名单；`landlock` / `seccomp` 只允许该种 |
 | `CST_SHELL` | shell 解释器路径（覆盖 busybox/`sh`） |
 | `CST_EXE_DIR` | 可执行文件目录（Termux 旁路 busybox 时有用） |