feat(openclaw): end-to-end Tier 2 plugin install and runtime - #534

Two compounding bugs prevented OpenClaw Tier 2 capsules from starting
on Linux:

1. Mount ordering: --tmpfs for hidden paths (e.g. ~/.astrid) was applied
   BEFORE writable --bind mounts, causing the tmpfs to erase the capsule
   directory. In bwrap, later mounts override earlier ones — reordered so
   hidden tmpfs comes first and writable bind-mounts punch through after.
   This mirrors the ancestor check already present in the macOS Seatbelt
   path (PR #534).

2. AppArmor: Ubuntu 24.04+ blocks unprivileged user namespaces by default
   (kernel.apparmor_restrict_unprivileged_userns=1), silently killing bwrap.
   Added a cached probe (bwrap --unshare-user -- /bin/true) that detects
   this at startup and falls back to unsandboxed execution with a clear
   warning, rather than producing a misleading 'connection closed' error.

Closes #648

## Linked Issue

Closes #648

## Summary

Two compounding bugs prevented OpenClaw Tier 2 (Node.js) capsules from
starting on Linux. The macOS Seatbelt path was already fixed in PR #534
— this ports the fix to the Linux bwrap path and adds AppArmor
detection.

## Changes

- **Mount ordering fix:** Reordered `build_bwrap_prefix()` so hidden
`--tmpfs` overlays come before writable `--bind` mounts. In bwrap, later
mounts override earlier ones — capsule bind-mounts now punch through the
`~/.astrid` tmpfs overlay instead of being erased by it.
- **AppArmor/bwrap probe:** Added `bwrap_available()` with a cached
probe (`bwrap --unshare-user --ro-bind / / -- /bin/true`). When user
namespaces are blocked (Ubuntu 24.04+ default), `sandbox_prefix()`
returns `None` and the existing unsandboxed fallback in `server.rs` runs
with a clear warning.
- **Distro-aware install hint:** When bwrap is missing,
`bwrap_install_hint()` reads `/etc/os-release` and logs the correct
install command for the detected package manager
(apt/dnf/pacman/apk/zypper/xbps/nix).
- **Module split:** `sandbox.rs` (1241 lines) split into
`sandbox/mod.rs` (629), `sandbox/bwrap.rs` (385), `sandbox/seatbelt.rs`
(189) to stay within the CI line limit.
- **Server test resilience:** 4 `astrid-mcp` server tests updated to
accept both sandboxed and unsandboxed command shapes, since bwrap may be
unavailable in CI containers.
- **CHANGELOG.md** updated under `[Unreleased] > Fixed`.

## Test Plan

### Automated

- [x] `cargo test --workspace` passes (2 pre-existing socket test
failures unrelated to this PR)
- [x] No new clippy warnings (`cargo clippy --workspace -- -D warnings`)
- [x] `cargo +nightly fmt --all --check` passes

New tests added:
| Test | File | Covers |
|---|---|---|
| `test_bwrap_prefix_writable_inside_hidden_path` | `bwrap.rs` | Bug 2:
writable root inside hidden path → bind after tmpfs |
| `test_seatbelt_prefix_writable_inside_hidden_path` | `seatbelt.rs` |
macOS equivalent: ancestor check skips deny rule |
| `test_bwrap_probe_success` | `bwrap.rs` | Probe interprets exit 0 as
available |
| `test_bwrap_probe_namespace_denied` | `bwrap.rs` | Probe interprets
AppArmor/namespace failure as unavailable |
| `test_bwrap_probe_not_found` | `bwrap.rs` | Probe interprets missing
binary as unavailable |
| `test_bwrap_install_hint_returns_nonempty` | `bwrap.rs` | Install hint
always returns non-empty string mentioning bubblewrap |

### Manual

- Built and ran `cargo test -p astrid-workspace -- sandbox` in Docker
(`ubuntu:24.04`) — all 28 Linux tests pass.
- Verified bwrap probe returns `false` in unprivileged Docker container
(simulates AppArmor restriction).
- Verified bwrap probe returns `true` in `--privileged` Docker
container.

## Checklist

- [x] Linked to an issue
- [x] CHANGELOG.md updated under `[Unreleased]`

…857)

## Linked Issue

Closes #855

## Summary

`SandboxCommand::wrap` — the macOS arm of the `host_process` spawn path
— disabled the OS-level subprocess sandbox on **every current Mac**
(Darwin >= 24 = macOS 15 Sequoia / macOS 26) and returned the command
**completely unsandboxed**, behind:

```rust
if seatbelt::darwin_major_version() >= 24 {
    tracing::warn!("macOS 15+ detected: sandbox-exec is deprecated. Running host process unsandboxed.");
    return Ok(inner_cmd);
}
```

On `host_process`-capable capsules (`astrid-capsule-shell`) every native
subprocess then inherited the host user's full filesystem reach — it
could read `~/.ssh`, dotfiles, and write anywhere the user can — with a
single `tracing::warn!` as the only signal. Containment also depended on
which spawn path a capsule happened to use: the MCP path
(`ProcessSandboxConfig::sandbox_prefix`) has **no** version guard and
sandboxed on the same machine.

### Root cause

The premise of the guard — that `sandbox-exec` is deprecated and
therefore non-enforcing on macOS 15+ — is **false**. `sandbox-exec` is
deprecated but still enforces on current macOS. The SIGABRT that
motivated the guard (introduced in #603, no reproducer, merged without
review) was a fail-closed **profile defect**: `wrap`'s inline profile
was a stale duplicate that omitted `(allow file-read* (literal "/"))`. A
dynamically-linked binary like `node` stats the filesystem root `/`
during `dyld` init; the profile denied it, Seatbelt correctly aborted
the process, and the guard converted that fail-closed signal into a
silent fail-open passthrough. The correct profile already lives in
`build_seatbelt_prefix` (it carries `(literal "/")` + `(allow mach*)`,
added for Node.js in #534) and runs on macOS 15+ via the MCP path.

## Changes

- Remove the `darwin_major_version() >= 24` guard and the stale
duplicate inline profile in `wrap`.
- Route `wrap`'s macOS arm through `build_seatbelt_prefix` — a single
Seatbelt profile now backs **both** the `wrap` and MCP spawn paths.
- Drop the now-dead `darwin_major_version` helper.
- Fail-closed by construction: if `sandbox-exec` genuinely can't run,
the spawn errors (`ENOENT`) and the subprocess never launches — never a
silent unsandboxed launch. (Matches the `SandboxPolicy::Required`
posture from #655.)
- `wrap` no longer has a panic path (the builder returns `io::Result`);
its `# Panics` doc is removed.

## Test Plan

### Automated

- [x] `cargo test -p astrid-workspace` green (56 passed), including:
- `seatbelt_root_read_is_load_bearing_for_real_binary` — spawns a **real
`node`** under the generated profile and asserts it runs (T1), then
strips `(literal "/")` and asserts the same profile **fails closed**
(T3). Skips cleanly when `node` or a usable `sandbox-exec` is absent
(e.g. nested-sandbox CI).
- `wrap_always_sandboxes_via_shared_profile` — `wrap` now always returns
a `sandbox-exec`-wrapped command carrying the root-read rule (never a
passthrough).
- [x] No new clippy warnings — `cargo clippy --workspace --all-features
-- -D warnings` clean for the changed crate; `astrid-capsule` (the
consumer) compiles.

### Manual

- [x] Verified on **Darwin 25.2**: T1 exits 0, T3 fails closed — matches
the issue's repro table.

## External verification

The deprecation claim and SBPL mechanism were independently verified
against documentation:

- `sandbox-exec` is **deprecated but still enforcing** on macOS 15 /
macOS 26 (Apple DTS confirmation that it remains functional with no
supported replacement for non-App-Store process sandboxing; third-party
reports debugging live Seatbelt denials on Darwin 25 in Dec 2025;
Chrome/Firefox/Homebrew/SwiftPM still depend on it).
- `(literal "/")` grants only a `stat` on the **root inode**, not the
recursive access `(subpath "/")` would — so the fix is minimal-aperture,
not a widening.
- App Sandbox / entitlements require a signed `.app` bundle and
**cannot** wrap arbitrary spawned binaries like `node`, so
`sandbox-exec` is the only mechanism for this use case.

## Notes / follow-ups

- `(allow mach*)` in the shared profile is a deliberately broad wildcard
— pragmatic for running general-purpose binaries (e.g. `node`'s
`os.cpus()` needs `mach-host*`), a conscious trade-off.
- If Apple ever removes `sandbox-exec`, the correct response is a real
replacement, **not** another silent-fallback version guard
(fail-secure).
- Kernel-internal sandbox wiring: no WIT/IPC/capability-contract change,
so no RFC.
- Security fix that should land in **0.8.0** — once merged I'll rebase
the release PR (#854) so this entry folds into `[0.8.0]`.

## Checklist

- [x] Linked to an issue
- [x] CHANGELOG.md updated under `[Unreleased]`