fix(runner): the lease sandbox binds the transport the engine actually spawns

M170 §3 narrowed the lease sandbox to three read-only paths on the premise
that no executable is needed inside a lease at all. The premise was false:
the NullClaw engine's model transport spawns `curl` (ten provider modules
reach `sse.curlStream*` / `http_util.curlPost*`), as does the `http_request`
tool. With `/usr` and `/lib` unbound, `curl` and its shared libraries do not
exist inside a lease and every lease dies at `execve` before its first model
call — not merely losing a tool.

Restore the executable and library trees; keep the credential trees out.
`/opt` (the daemon's control-plane token) and the broad `/etc` (the host
account database) stay refused at compile time, which was always the real
exposure. Every baseline entry is now a `DANGER_HOST_`-prefixed constant, so
`grep DANGER_HOST_` returns the complete lease-reachable host surface, and a
comptime guard refuses a bare path literal appended to the list.

Landlock now lands the rule for a regular file: `SYSTEM_READONLY_ACCESS`
carries `READ_DIR`, which the kernel refuses on a non-directory, so the
`/etc/hosts` rule returned EINVAL and `catch continue` ate it — bind-mounted
and unreadable with every list test green. `addPathRule` retries with the
file-accepted subset, and a kernel refusal now fails the lease instead of
sharing an arm with a path that is merely absent.

The self-test gains a `transport=` row: the parent resolves the host's
transport binary and the probe spawns it from behind the full wall, so the
runner measures on every heartbeat what this milestone previously reasoned
about once. A host carrying no transport reads as its own named fault,
distinct from one whose exec was attempted and refused.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>