fix(policy): harden landlock.compatibility validation

[letv1nnn]

Summary

1. Invalid compatibility values (e.g. hard-requirement) were accepted without error and silently treated as best_effort. Fixed by parsing into an enum at YAML parse time and TryFrom implementation at the proto conversion layer.
2. hard_requirement with no filesystem paths configured was a silent no-op, Landlock skipped entirely. Fixed by erroring before the early return when hard_requirement is set and both path lists are empty.

Related Issue

closes NVIDIA#2356

Changes

Two fixes to landlock.compatibility enforcement. Invalid values now fail at YAML parse time instead of silently falling back to best_effort. Configuring hard_requirement with no filesystem paths now aborts sandbox startup instead of skipping Landlock entirely. Docs updated to reflect the new behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[letv1nnn]

pushed upstream