Add Linux Landlock sandbox

[MikeMcQuaid]

This may be a suitable substitute for Bubblewrap that'd be easier to use in e.g. CI environments.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex GPT 5.6 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR adds an alternative Linux sandbox implementation using Landlock, intended to reduce reliance on Bubblewrap (notably in CI/container environments) while keeping the existing Bubblewrap sandbox as the default.

Changes:

• Introduces Sandbox::Landlock and refactors Linux sandboxing to select between Landlock and Bubblewrap via HOMEBREW_SANDBOX_LINUX_LANDLOCK.
• Updates Linux diagnostics and dependency collection behaviour for the Landlock opt-in.
• Adjusts CI to enable Landlock and removes the container --privileged requirement.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Library/Homebrew/test/sandbox_linux_spec.rb	Updates Linux sandbox specs for Bubblewrap class extraction and adds implementation-selection coverage.
Library/Homebrew/test/sandbox_landlock_spec.rb	Adds focused unit tests for Landlock availability, rule application, and command preparation constraints.
Library/Homebrew/test/os/linux/diagnostic_spec.rb	Ensures Linux diagnostics tests aren’t affected by the Landlock opt-in and adds a Landlock-unavailable diagnostic case.
Library/Homebrew/test/os/linux/dependency_collector_spec.rb	Covers dependency collector behaviour when Landlock is selected.
Library/Homebrew/sandbox.rb	Adds an apply_sandbox hook invoked in the child process before exec.
Library/Homebrew/extend/os/linux/sandbox/landlock.rb	Implements Landlock sandboxing (availability probing + rule application).
Library/Homebrew/extend/os/linux/sandbox/bubblewrap.rb	Extracts Bubblewrap sandboxing into its own class (previously embedded in Linux sandbox extension).
Library/Homebrew/extend/os/linux/sandbox.rb	Refactors Linux sandbox extension to delegate to the selected implementation and applies Landlock restrictions before exec.
Library/Homebrew/extend/os/linux/diagnostic.rb	Updates sandbox diagnostics to account for Landlock opt-in messaging.
Library/Homebrew/extend/os/linux/dependency_collector.rb	Avoids Bubblewrap dependency when Landlock is selected.
.github/workflows/tests.yml	Enables Landlock in CI and removes privileged container option.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[p-linnane]

This is looking great. A couple small things.