Adopt the syscalls crate for syscall numbers, names, and sets

[congwang-mk]

Replaces Sandlock's hand-maintained syscall tables with the syscalls crate
(BSD-2, generated from the kernel ABI), so the crate is the single source of
truth for syscall numbers, names, and per-architecture presence.

What changed

• Name to number resolution. The 110-line hand-written match in
  seccomp/syscall_names.rs is replaced by Sysno::from_str, then folded into
  seccomp::syscall next to the Syscall checked newtype, so that module owns
  syscall identity (name, number, validity).
• Validity is exact. is_known_syscall now uses Sysno::new(nr) instead of
  a nr <= MAX_SYSCALL_NR range check, so unassigned holes are rejected and the
  drifting MAX_SYSCALL_NR constants are gone.
• arch.rs is now pure ABI. The per-arch numeric constants and the legacy
  Option<i64> tables (open, stat, fork, etc., previously hand-listed x3 arches)
  are derived from the crate. The only hand-maintained per-arch datum left is
  AUDIT_ARCH, a linux/audit.h token the crate does not provide.
• Subsystem groups consolidated. Each path-syscall group (procfs, cow,
  chroot, fs_denied) is now one function combining its modern and legacy
  members, kept in context.rs with the other policy lists.
• Blocklists built with SysnoSet. blocklist_syscall_numbers and
  no_supervisor_blocklist_syscall_numbers collapse into one helper that
  accumulates into a SysnoSet: inherent dedup (SysV IPC folds in via
  insert), ascending order, no manual sort/dedup/contains.

Behavior notes

• nfsservctl now resolves and is enforced in the blocklist. Previously it was
  in the blocklist intent but silently dropped (no libc constant), so this is a
  latent fix, not a regression.
• extra_deny_syscalls and handler registration by name now accept any real
  syscall name, not just the previously curated subset. Typos still resolve to
  nothing and are rejected by name validation.

Testing

• 316 sandlock-core lib unit tests pass; clean build, no warnings.
• New guards: per-arch pin of the crate-sourced numbers to historical values,
  per-arch legacy-accessor presence, and a libc::SYS_* cross-check.

Cross-arch caveat

Validated on x86_64 here. The per-arch tripwire tests are written for aarch64
and riscv64 too but need CI on those targets to actually run.

🤖 Generated with Claude Code