Function apply_if_requested 

pub fn apply_if_requested() -> SandboxReport

Apply the Landlock sandbox if WINX_SANDBOX is set. Infallible: any problem is reported and the process continues (possibly unsandboxed). The cwd at startup is taken as the workspace and granted read-write. MUST be called before logging or the async runtime create threads so every child inherits the Landlock domain.