## Why
`request_key` can invoke host helpers that make network requests outside the sandbox's network namespace and proxy policy.
## What changed
Deny `request_key` with `EPERM` in the `Restricted` and `ProxyRouted` seccomp modes, leaving `VmSocketRestricted` unchanged.
## Testing
Add a threaded syscall regression test covering all three modes. Install a baseline filter returning `ENOSYS` so the probe cannot invoke host helpers and inherited `EPERM` filters cannot hide regressions.
GitOrigin-RevId: 196de45ea4da3e40d2f2264ff88ed10d3e5bcdda
## Why
The x32 ABI shares the x86-64 audit architecture, so the architecture check alone does not enforce syscall restrictions for x32 callers.
## What changed
Apply existing syscall denials and socket-family conditions to x32 syscall numbers on x86-64, including separate x32 numbers and legacy aliases supported before Linux 5.4.
## Testing
Add probes across all three network seccomp modes to verify that restricted native and x32 calls return `EPERM`, allowed calls preserve their behavior, and socket-family restrictions apply to both ABIs.
GitOrigin-RevId: fa38138d6b6c7b26dfafd6c931880ee1265a1b94
## What changed
Extract the inline test modules for `bundled_bwrap`, `bwrap`, `exec_util`,
`launcher`, `proxy_routing`, and `seccomp` into sibling `*_tests.rs` files.
Keep them wired through `#[cfg(test)]` and explicit `#[path]` attributes,
with existing test coverage and runtime behavior unchanged.
GitOrigin-RevId: 79b70a092a19b10716939744542415bc1dcaf0b2
dhavalkapil-oai