feat(linux-sandbox): activate managed DNS resolution

[viyatb-oai]

Summary

• mount a generated resolver configuration at the canonical resolver path only when filesystem policy permits both the logical path and its target
• enter the isolated network namespace with only the setup capabilities needed to bind the loopback resolver, then drop and verify every capability before restoring loader state
• keep direct DNS egress isolated while ordinary libc resolution uses the policy-checked UDP and TCP stub
• cover A, AAAA, CNAME, denied names, denied canonical targets, TCP framing, resolver mounting, loader ordering, and residual capabilities

Compatibility

• the DNS setup path relies on bubblewrap capability passthrough; setuid bubblewrap rejects capability additions for non-root callers
• the launch-time domain-policy snapshot matches the other operating-system sandbox inputs; running commands keep the policy they started with

Testing

• cargo test --offline in an isolated DNS module harness (3 passed)
• resolver hook fixture compiled with cc -fsyntax-only
• just fix -p codex-linux-sandbox
• end-to-end namespace coverage runs on Linux CI

Stack: 4 of 5, on #31644.