Cross-platform process sandbox with kernel-enforced isolation
Description
arapuca applies OS-level sandbox restrictions to processes using
kernel security primitives. On Linux: Landlock LSM filesystem
confinement, seccomp BPF syscall filtering, cgroup v2 resource
limits, and network namespace isolation.
Provides a C-compatible static library (libarapuca.a) with header
and pkg-config file for embedding in C, Go, and other FFI-capable
languages.
