Function fs_confinement_available 

pub fn fs_confinement_available() -> bool

Whether filesystem write-confinement is really available on this platform: Linux when the Landlock ruleset assembles, macOS when /usr/bin/sandbox-exec exists, false everywhere else. Like network_killswitch_available: a safe probe that restricts nothing. (On Linux enforcement remains best-effort at apply time — a pre-Landlock kernel builds the ruleset but cannot enforce it.)