test(sandbox): isolate Landlock descriptor-limit regression

[grs]

Summary

Fix an intermittent Landlock regression test failure caused by counting descriptors shared with concurrently running tests. Verify actual baseline preparation in an isolated subprocess under a low descriptor limit.

Related Issue

Closes #4455

Changes

• Replace process-wide descriptor counting with preparation of 128 entries under a 64-descriptor limit.
• Confine the descriptor-limit change to a subprocess.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.