Replaces the deferred seccomp stub with a real pure-Go compiler that
reproduces lix's syscall allowlist (libstore/platform/linux.cc
compileSyscallFilter). Lix delegates filter generation to libseccomp,
which gonix cannot link under CGO_ENABLED=0, so we generate the
classic-BPF program ourselves.
The new builder/bpf package is layered: a label-based cBPF assembler, a
minimal cBPF interpreter used as a test oracle, and a rule compiler that
emits a multi-arch program (arch dispatch, a binary-search tree over
sorted syscall numbers, and fully self-contained leaf groups whose RETs
are inlined locally). Inlining keeps every conditional jump within the
8-bit offset limit, so no trampolining is needed and the assembler
statically rejects any overflowing jump. Per-arch syscall tables are
generated via go:generate using go/packages to resolve each ABI's
SYS_* constants, giving full multi-arch parity without hand
transcription.
Correctness is verified by the interpreter against a reference
evaluator: structural routing tests, exhaustive per-syscall checks, and
a differential fuzz target (millions of executions, zero divergence).
An in-sandbox test confirms a setuid chmod is denied (EPERM) while a
benign chmod succeeds on a live kernel. Wired into BuildSpec.ToRequest
with a NoSeccomp escape hatch.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Change-Id: I690245ae6b6f0513a488f6a2fac2e945e3e6a850