fix(sandbox): validate filesystem policy anchors

crates/openshell-sandbox/README.md

@@ -10,6 +10,13 @@ the lower-level mechanisms used by that orchestration and the boundary server.
 Unsafe kernel ABI, process-launch, and descriptor-ownership operations stay in
 this runtime crate behind safe APIs where their contracts can be enforced.
 
+Landlock policy anchors are resolved relative to open directory descriptors.
+Symlinks are followed only through ancestors that the workload neither owns nor
+can write, preserving system aliases while rejecting mutable workspace links.
+The rule uses the resolved descriptor directly. Unsafe resolution and an empty
+effective allowlist fail the launch independently of Landlock compatibility;
+they cannot trigger the best-effort fallback to baseline-only restrictions.
+
 The network broker retains source socket descriptors only while preparing a
 workload endpoint. A successful connection or `listen` releases that reference;
 the kernel then tracks the lifetime through workload-owned descriptors. Native