feat(py): the worker's Linux seccomp filter and network block

[jat255]

This PR adds the worker's seccomp filter and its network="none" socket block, built as ctypes BPF programs and installed with prctl. It also fills in the seccomp field of the construction-time gate, so that gate makes a real decision on Linux.

Stacked on #355. Nothing calls engage() yet; the worker that will is task 6.

Agent-written detail

The filter matches raw syscall numbers, so _seccomp.py carries a table for each of the four architectures the R implementation supports. The numbers came from each architecture's kernel headers rather than from memory: they diverge below 425, and pivot_root is 217 on i386 but 218 on arm.

Two entry points the R filter does not screen are screened here, and kata mv69 tracks closing them there. socketcall reaches every socket operation on i386 behind one number. pidfd_getfd hands over a descriptor belonging to another process of the same user, which is a capability no filesystem sandbox granted; it postdates that C and looks like an omission rather than a decision.

x32 is the one ABI reporting a 64-bit machine with 32-bit pointers, and it belongs to neither table, so it gets no entry and such a host is refused rather than handed a filter that would reject its every call. A 32-bit i386 process is not that case: the kernel reports i686 to it.

seccomp_available() finds out whether a filter installs by installing an allow-all one in an isolated child, because a kernel that answers PR_GET_SECCOMP can still refuse PR_SET_SECCOMP, and a gate that missed that would approve a host whose worker then fails to start.

The tests run the filter programs through a small BPF interpreter, which is how one machine checks all four tables. The Linux ones engage for real in a child, since a filter cannot be lifted, and three of them first check the host does not already refuse the call, so they skip rather than passing hollowly inside a container. Verified under three container profiles: default, unconfined, and one that permits PR_GET_SECCOMP while denying PR_SET_SECCOMP, where the suite skips cleanly instead of failing.

CI gains one arm64 leg, so the aarch64 numbers are exercised rather than merely built. kata 9jmj covers the 32-bit tables, which need a container job rather than the current uv matrix. kata hm25 records a separate gap this surfaced: abstract-namespace AF_UNIX sockets are reachable through socketpair and no filesystem sandbox governs them, which belongs with the Landlock and userns tasks.