[security] Kernel enforcement can be absent without anyone noticing #123

Context

The containment layer is platform- and kernel-dependent. openat2 needs Linux >= 5.6; the no-follow walk needs openat, which other platforms lack. Where that is missing, kernelEscapeCheck returns false and openBeneathRoot reports "unsupported", so the caller falls back to a plain open after the portable userspace checks.

The fallback is correct and deliberate, but it is a capability downgrade that nothing reports. It is visible only in code comments and debug logs. Neither the tool result nor the session record says "this ran with userspace checks only", so:

• a caller that needs a hard boundary cannot tell the difference;
• a silent downgrade cannot be caught in CI, on a platform, or after a kernel change;
• the same will be true of the command-confinement backend once it exists (there it is worse: no backend means no boundary at all).

What to build

• An enforcement fact per operation — at minimum kernel vs userspace, extended to full/partial once a command backend exists — reported in the tool result next to the existing sandbox facts and persisted with the session.
• A startup probe that records which containment mechanisms and which command-confinement backend are actually usable, and surfaces the verdict once (log + runtime context) instead of failing at first use.
• An opt-in "require a hard boundary" setting: when on, an operation that would fall back to userspace-only checks is refused with a clear error rather than silently weakened.

Acceptance

• A test that disables the kernel path asserts the result carries the userspace fact; with the hard-boundary requirement on, the same operation is refused.
• On a platform without openat2, the fact is visible in a tool result — not only in a log line.
• The startup verdict is deterministic and testable on a machine where the backend is missing, and a test asserts the probe runs once per process.
• The fact appears in the persisted session record, so a later reader can tell how an operation was enforced.

Related: #121 (kernel boundary for bash).

Verification

• Go. The enforcement fact is kernel where the kernel path is active and userspace where it is disabled; with "require a hard boundary" on, the same operation is refused. The startup probe runs once per process, and its verdict is deterministic on a host without the backend.
• Persistence. The fact is asserted in the written session record, so a later reader can tell how an operation was enforced.
• Scenario — only if the fact gets a screen representation. A fact that lives in a tool result is invisible: the TUI renders tool calls, not result text, and nothing else shows it. Recommended companion: a /sandbox command (or a status-bar indicator) printing the active backend, the enforcement level, and the effective writable roots. Then tui/testdata/scenarios/confine-status.scenario asserts that output, including its degraded wording on a host without the kernel path — and a silent downgrade becomes visible to the person running the agent, not only to a debug log. Without that representation this issue stays Go-only.

Landing plan and progress: #127.