Function apply_if_requested 

pub fn apply_if_requested()

Apply the Landlock sandbox if WINX_SANDBOX is set. Infallible: any problem is logged and the process continues (possibly unsandboxed). The cwd at startup is taken as the workspace and granted read-write. MUST be called before the async runtime is built so its worker threads inherit the Landlock domain.