Function apply_linux_confinement 

pub fn apply_linux_confinement(
    cmd: &mut Command,
    confine_fs: bool,
    fs_allow_writes: bool,
    cwd: PathBuf,
    extra_write_dirs: Vec<PathBuf>,
    confine_net: bool,
)

Real fs/net confinement, installed on cmd as a pre_exec closure that runs in the FORKED CHILD (after fork(), before exec() — crate::agent::Agent/supercode itself is never touched; only the spawned subprocess tree is). cwd/extra_write_dirs MUST already be resolved via [crate::safe_path::resolve_real] (real, symlink-resolved paths) — Landlock rules operate on directory file descriptors opened from these exact paths, so the same dual lexical+resolved discipline every other containment check in this crate uses applies here too (a symlink’d cwd must grant the REAL target directory, not the symlink’s lexical location).