## What changed
Extract the inline test modules for `bundled_bwrap`, `bwrap`, `exec_util`,
`launcher`, `proxy_routing`, and `seccomp` into sibling `*_tests.rs` files.
Keep them wired through `#[cfg(test)]` and explicit `#[path]` attributes,
with existing test coverage and runtime behavior unchanged.
GitOrigin-RevId: 79b70a092a19b10716939744542415bc1dcaf0b2
## Why
The Linux sandbox uses bubblewrap for filesystem isolation and seccomp for syscall filtering, but its command type, syscall-filter module, and integration test suite still used Landlock names.
## What changed
- Rename `LandlockCommand` to `LinuxSandboxCommand`, `src/landlock.rs` to `src/seccomp.rs`, and `tests/suite/landlock.rs` to `tests/suite/sandbox.rs`, updating imports and existing tests.
- Clarify the retained legacy Landlock implementation and its filesystem-policy limitations.
- Update the README to describe existing network filtering, `AF_VSOCK` and `io_uring` restrictions, and managed-proxy Unix socket behavior, including allowed Unix socket pairs.
Sandbox enforcement behavior is unchanged.
GitOrigin-RevId: be4769d5a10b90605990eb58451e83fdf1c31222
Michael Bolin