feat(py): the macOS seatbelt sandbox the worker engages on itself

[jat255]

This PR adds the macOS seatbelt sandbox the execution worker engages on itself, reached through ctypes so it needs no compiled extension, and it fills in the seatbelt field of the capability probe from #352.

Stacked on #352, so review that one first. Roots are arguments rather than computed here: the worker entry point is where the scratch directory and the parent's tmpdir are known, so it assembles the root set when it lands. Tracked as kata tpw5.

Agent-written detail

The profile follows the rules and the order of the Darwin branch of pkg-r/src/sandbox.c: a permissive default, then each filesystem deny immediately followed by its allowlist, because later rules win in SBPL. Write roots are granted for reading too, /dev/null stays a writable literal, and file-read-metadata stays allowed so path traversal keeps working.

Two things differ from the R implementation. A root that is not absolute is rejected, which R does not check, because realpath would otherwise resolve it against the worker's cwd and grant some unrelated directory. And the read allow is left out entirely when there is nothing to grant, rather than emitted with no path predicate; an unscoped allow sitting after the deny would hand back every readable file on the host. The local review caught that as a real hole, and there is now a live test that fails without the fix.

protection_mode() starts returning "sandbox" on macOS instead of raising. That is the intended direction, and nothing calls it from Commons.__init__ yet (task 12, kata 2q9b), so no construction path changes here. The probe looks the symbol up rather than trusting the platform name, so a macOS that finally drops these entry points (deprecated since 10.8) reports no seatbelt instead of promising one the worker cannot engage.

No tests/shared/ fixture for this: R builds its profile inside sandbox.c with nothing reachable from R's test suite, so a shared fixture could not be executed by both suites. The observable behaviour is pinned per language against the same C source of truth.

The two tests for the platform check call _seatbelt_present() rather than sandbox_capabilities(). Claiming to be Linux means patching the shared platform module, so going through the aggregate would send the seccomp and Landlock probes down their Linux paths on a host that has neither interface.

Testing. Profile generation is pure, so its rules run on any host. The live path is exercised for real on macOS and skipped elsewhere: a subprocess engages the seatbelt and then proves a write inside its root succeeds, a write outside raises, a read outside the read roots is denied, /dev/null stays writable, and the network rule blocks a connection to a listener in the test process, which keeps the test off the internet. The subprocess imports the module by directory rather than through commons, which is how the worker reaches it and proves it needs nothing from the package. ruff check, pyrefly check src tests, and the full pytest run are clean; pyrefly's six remaining errors are missing optional OpenTelemetry imports that predate this branch.