Security: Implement defense-in-depth jailer for shim process

## Summary

BoxLite currently relies almost entirely on VM isolation. If a guest escapes the VM boundary, there are minimal additional barriers - the shim runs with the same privileges as the host application.

This issue tracks implementing a Firecracker-style jailer to provide defense-in-depth security.

## Current State

| Aspect | Current | Target |
|--------|---------|--------|
| Isolation layers | 1 (VM only) | 4+ layers |
| Post-escape access | Full host app privileges | Isolated chroot jail |
| Syscall filtering | None | Whitelist seccomp |
| Privilege level | Same as host app | Unprivileged UID/GID |

## Proposed Solution

Implement multi-layer isolation inspired by Firecracker's jailer:

### Linux
1. **Namespace isolation** - Mount, PID, network namespaces
2. **Chroot/pivot_root** - Filesystem isolation to `/srv/boxlite/{box_id}/`
3. **Seccomp filtering** - Syscall whitelist (~40 allowed syscalls)
4. **Privilege dropping** - Run as unprivileged user after setup
5. **Resource limits** - cgroups v2, rlimits

### macOS
1. **Sandbox (Seatbelt)** - `sandbox-exec` with SBPL profile
2. **Resource limits** - rlimits
3. **FD/environment cleanup** - Close inherited FDs, sanitize env vars

## Implementation Plan

### Phase 1: Foundation (Non-Breaking)
- [ ] Create `jailer/` module with SecurityOptions config
- [ ] Implement FD cleanup and environment sanitization
- [ ] Add resource limits (rlimits)
- [ ] Create macOS sandbox profile (boxlite.sb)

### Phase 2: Platform Hardening
- [ ] Linux: Implement namespace isolation
- [ ] Linux: Implement chroot/pivot_root
- [ ] Linux: Implement seccomp filtering
- [ ] Linux: Implement privilege dropping
- [ ] macOS: Integrate sandbox-exec spawning
- [ ] Integrate jailer into shim.rs

### Phase 3: Resource Limits
- [ ] Linux: cgroups v2 support
- [ ] Security presets (development/standard/maximum)

### Phase 4: Polish
- [ ] Documentation (docs/security.md)
- [ ] Integration tests for isolation
- [ ] Performance benchmarks

## API Design

```rust
pub struct SecurityOptions {
pub jailer_enabled: bool, // default: true
pub seccomp_enabled: bool, // default: true (Linux)
pub uid: Option, // None = auto-allocate
pub gid: Option, // None = auto-allocate
pub chroot_enabled: bool, // default: true (Linux)
pub resource_limits: ResourceLimits,
}

impl SecurityOptions {
pub fn development() -> Self { /* jailer disabled */ }
pub fn standard() -> Self { /* recommended */ }
pub fn maximum() -> Self { /* all features */ }
}
```

## References

- Firecracker jailer: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md
- Kata rootless VMM: https://github.com/kata-containers/kata-containers/blob/main/docs/how-to/how-to-run-rootless-vmm.md
- macOS sandbox-exec: https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox-Guide-v1.0.pdf

## Success Criteria

- [ ] VM escape only grants access to chroot jail, not host filesystem
- [ ] Shim runs as unprivileged UID/GID (not root)
- [ ] Seccomp blocks mount, ptrace, execve syscalls
- [ ] Resource limits enforced via cgroups
- [ ] macOS uses sandbox-exec for file/network restrictions
- [ ] No performance regression >5% on box startup