fix(sandbox): close io_uring and sendmmsg holes in the child network filter

Port of upstream grok-build 9684fa3 (1.0.11 window) `child_net.rs`.

The per-child seccomp filter matched seven socket syscalls by number and
allowed everything else, so a restricted child could still reach the
network through `sendmmsg` or an io_uring submission queue, and a
syscall issued through another arch table (x32 on x86_64) never matched
the deny list at all.

- Gate on the audit arch before matching `nr` and reject x32 numbers on
  x86_64 (foreign-table syscalls now get EPERM instead of passing).
- Add `sendmmsg`, `io_uring_setup`, `io_uring_enter`, `io_uring_register`.
- Build the program once (`prebuilt_child_network_filter`) and hand the
  slice to the `pre_exec` installer; the old code allocated the Vec after
  `fork`, which is not async-signal-safe. All three callers updated.
- Tests evaluate the BPF program over synthetic `seccomp_data`.

Claude-Session: https://claude.ai/code/session_01RUqV8HVGXcAETyYbZ2tPQ4

crates/codegen/kigi-tools/src/computer/local/terminal.rs

@@ -634,7 +634,8 @@ impl LocalTerminalActor {
         #[cfg(target_os = "linux")]
         if kigi_sandbox::should_restrict_child_network() {
             unsafe {
-                cmd.pre_exec(|| kigi_sandbox::child_net::install_child_network_filter());
+                let filter = kigi_sandbox::child_net::prebuilt_child_network_filter();
+                cmd.pre_exec(move || kigi_sandbox::child_net::install_child_network_filter(filter));
             }
         }
 
@@ -2646,7 +2647,8 @@ fn spawn_shell_command(
         #[cfg(target_os = "linux")]
         if kigi_sandbox::should_restrict_child_network() {
             unsafe {
-                cmd.pre_exec(|| kigi_sandbox::child_net::install_child_network_filter());
+                let filter = kigi_sandbox::child_net::prebuilt_child_network_filter();
+                cmd.pre_exec(move || kigi_sandbox::child_net::install_child_network_filter(filter));
             }
         }
         cmd