Warns (non-fatal, once per declared grant) for every capabilities.shell.interpreter_runtime
entry. Declaring one narrows an allowlisted binary’s Landlock scope to specific host
directories so a path-based interpreter can reach its stdlib — but it couples the capsule to a
specific host distro/interpreter-version layout (e.g. /usr/lib/python3.11 stops resolving the
moment the host ships Python 3.12), which the operator should see plainly. The durable fix is
the still-unbuilt staged runtime bind-mount; this grant only bridges until then.