Function apply_sandbox_restrictions 

pub fn apply_sandbox_restrictions(
    policy: &SandboxPolicy,
    seccomp: &SeccompProfile,
    limits: &ResourceLimits,
    policy_cwd: &Path,
) -> Result<(), Error>

Apply every kernel-level restriction of the sandbox policy to the current process: resource limits, then Landlock filesystem rules, then seccomp.

Called by the sandbox-exec launcher. Fails closed: any error means the caller must not exec the wrapped command.