feat: add nsjail sandbox backend

[tdstein]

Summary

• add nsjail as an optional Linux run_r sandbox backend
• generate per-worker namespace, mount, environment, descriptor, and Kafel seccomp policy
• add Linux smoke-image tooling and sandbox documentation

Verification

• git diff --check
• Linux Docker image build succeeded
• Linux nsjail policy/config generation check succeeded
• Docker end-to-end smoke reaches nsjail, but Docker's default profile rejects nested unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWNET) with EPERM
• devtools::test(filter = "sandbox") still has two pre-existing macOS Seatbelt failures: sandbox_init failed: Operation not permitted

[github-actions]

Preview deployed to Connect (dogfood.team.pct.posit.it): https://dogfood.team.pct.posit.it/connect/#/apps/d7a36cae-8f27-448b-a478-61b81fbe3942/draft/361517

Deployed from commit 8574112.

[github-actions]

Preview deployed to Connect (connect.staging.pct.posit.it): https://connect.staging.pct.posit.it/connect/#/apps/ad662e1b-5048-4acc-9ad7-f9478c92274e/draft/1796

Deployed from commit 8574112.