test(sandbox): isolate landlock fd limit test

[ericcurtin]

Summary

Make the Landlock fd regression test deterministic by running it in a subprocess with a low fd limit.

Related Issue

Closes #4455

Changes

• Replace the /proc/self/fd count, which saw fds from parallel tests, with a subprocess that lowers RLIMIT_NOFILE below the entry count.
• Run the real prepare_capability_free_baseline_at instead of only the entry iterator.
• Reuse require_abi() for the ABI skip check.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy -p openshell-sandbox --all-targets -D warnings, and cargo test -p openshell-sandbox --lib (3 runs, 244 passed). Collecting all entry fds up front makes the test fail with EMFILE.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@drew @johntmyers PTAL when you get a chance, and /ok to test cd54555d7b7e670030ebdb7c0d8e4d2f7dc54efd if it looks good. Thank you!

[johntmyers]

dupe of #4457