fix(policy): harden landlock.compatibility validation

[letv1nnn]

Summary

1. Invalid compatibility values (e.g. hard-requirement) were accepted without error and silently treated as best_effort. Fixed by parsing into an enum at YAML parse time and TryFrom implementation at the proto conversion layer.
2. hard_requirement with no filesystem paths configured was a silent no-op, Landlock skipped entirely. Fixed by erroring before the early return when hard_requirement is set and both path lists are empty.

Related Issue

closes #2356

Changes

Two fixes to landlock.compatibility enforcement. Invalid values now fail at YAML parse time instead of silently falling back to best_effort. Configuring hard_requirement with no filesystem paths now aborts sandbox startup instead of skipping Landlock entirely. Docs updated to reflect the new behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[letv1nnn]

@krishicks, could you PTAL

[krishicks]

/ok to test 49a6eec

[krishicks]

Review findings

Verdict: Request changes

1. [P1] Gateway validation still accepts invalid protobuf values.

   LandlockPolicy::try_from rejects invalid values only when the sandbox converts the stored protobuf policy (crates/openshell-core/src/policy.rs:117). The gateway create path calls validate_policy_safety() before persistence, but that validator never examines landlock.compatibility (crates/openshell-server/src/grpc/validation.rs:704). A direct SDK/gRPC client can therefore submit and persist an invalid value; rejection occurs later during sandbox startup rather than returning INVALID_ARGUMENT as required by bug(policy): invalid landlock.compatibility values silently fall back to best_effort #2356. Additionally, from_proto() silently serializes any invalid value as best_effort (crates/openshell-policy/src/lib.rs:817), concealing the stored typo. Please add validation to the shared policy validator or gateway request path.

2. [P2] Neither regression has automated coverage.

   Despite the PR checklist claiming updated unit tests, the four changed files contain no test changes. At minimum, please cover:

   • Invalid YAML enum values are rejected with accepted values in the error.
   • Invalid protobuf values fail conversion/server validation.
   • Empty paths plus hard_requirement fails.
   • Empty paths plus best_effort remains a no-op.
   • An included workdir counts as a configured path.

3. [P2] Readiness logging contradicts the new failure behavior.

   For zero paths, log_sandbox_readiness() still emits a successful skipped: no paths configured OCSF event (crates/openshell-supervisor-process/src/sandbox/linux/mod.rs:101). Immediately afterward, the new check aborts startup under hard_requirement (crates/openshell-supervisor-process/src/sandbox/linux/landlock.rs:146). Operators receive a misleading success event for a configuration that fails. The readiness branch should account for compatibility and emit the appropriate failure/security event.

The typed serde enum is the right approach for YAML validation, and fallible protobuf-to-runtime conversion prevents silent enforcement downgrade inside the sandbox. The zero-path guard also closes the identified Landlock no-op. Gateway validation, logging, and regression coverage need completion before merge.

Verification

• openshell-policy: 148 tests passed.
• The affected crates compiled.
• Full openshell-core run: 346 passed; 10 unrelated socket tests failed because socket binding is prohibited in the restricted environment.
• Linux-only Landlock tests were unavailable on this host.
• The agent-maintenance map was checked; no companion skill update appears necessary.

[krishicks]

/ok to test a13f9d0