feat(jail): add tinybox-jail, a per-process directory jail

Landlock (Linux), Seatbelt (macOS), AppContainer (Windows), a noop
fallback and a persistent JailRegistry, moved from the OpenHuman host.
A cwd jail confines one spawned Command to a directory tree, distinct
from the box-level namespace isolation in tinybox-linux. The Landlock
backend sits behind the `landlock` feature; the crate opts out of the
workspace unsafe_code forbid because it is Win32 FFI and pre_exec.

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinybox-jail/src/windows.rs

@@ -28,6 +28,10 @@
 //! shipping. Win32 has many subtle wrong-trees you can bark up.
 
 #![cfg(target_os = "windows")]
+// Written for edition 2021, where the body of an `unsafe fn` is an unsafe
+// context. Each fn documents its own safety contract; re-scoping them into
+// per-call blocks is a separate, hardware-tested change.
+#![allow(unsafe_op_in_unsafe_fn)]
 
 use std::ffi::OsStr;
 use std::io;
@@ -100,9 +104,12 @@ use windows_sys::Win32::System::Threading::{
 
 use super::jail::{Jail, JailBackend};
 
+/// Windows AppContainer backend.
+#[derive(Debug)]
 pub struct AppContainerBackend;
 
 impl AppContainerBackend {
+    /// Creates the backend.
     pub fn new() -> Self {
         Self
     }