fix(sandbox): emit warning when Landlock filesystem sandbox degrades silently

[johntmyers]

Summary

• Upgrade Landlock degradation log from debug! to warn! so operators running at default log levels are alerted when the filesystem sandbox is bypassed
• Add info!-level startup log showing the requested ABI, compatibility mode, and path counts so operators always know what Landlock protections are active

Related Issue

Closes #584

Changes

crates/openshell-sandbox/src/sandbox/linux/landlock.rs

1. debug! → warn! on Landlock failure (line 82-86): When BestEffort mode swallows a Landlock error, the operator now sees a warn!-level message with an actionable hint to set hard_requirement if they want this to be fatal. Previously this was debug! — invisible at production log levels.

2. info! log at sandbox apply (lines 33-39): Logs the requested ABI version, compatibility mode, and number of read-only/read-write paths before applying Landlock rules. This gives operators a clear signal of what protections are being applied on every sandbox start.

Both changes align Landlock's observability with the existing pattern in netns.rs, which already uses warn! for similar degradation scenarios.

Testing

• cargo check -p openshell-sandbox — passes
• cargo clippy -p openshell-sandbox — no new warnings
• mise run pre-commit — passes (license check failure is pre-existing on architecture/plans/ files, unrelated)

Checklist

• Conventional commit format
• Pre-commit checks pass
• No secrets or credentials committed
• Changes scoped to the issue at hand