fix(sandbox): skip non-existent paths instead of abandoning Landlock ruleset

[latenighthackathon]

Summary

When a single path in the filesystem policy did not exist (e.g., /app in container images without that directory), PathFd::new() failed and the ? operator propagated the error to abandon the entire Landlock ruleset. Under the default best_effort compatibility mode, this silently disabled all filesystem restrictions for the sandbox.

This is a critical security degradation: one missing optional path causes the entire filesystem sandbox to be dropped, leaving the container with zero filesystem isolation.

Fix

Replace the ? operator on PathFd::new() with per-path match statements that:

• Warn and skip individual non-existent paths
• Continue building the ruleset from remaining valid paths
• Preserve filesystem isolation even when optional paths are missing

The existing error handling for ruleset creation and restrict_self() is unchanged. Only PathFd::new() failures are handled per-path.

Test plan

• Sandbox with all valid paths: Landlock applied normally (no regression)
• Sandbox with one missing path (e.g., /app): warning logged, remaining paths still enforced
• Sandbox with all paths missing: existing best_effort degradation behavior unchanged
• hard_requirement mode with missing path: still returns error (unchanged)
• cargo test passes

Closes #664

I have read the DCO document and I hereby sign the DCO.

[latenighthackathon]

I have read the DCO document and I hereby sign the DCO.