Expose restore_interactive through the C ABI and Python SDK

[congwang-mk]

Summary

Sandbox::restore_interactive() was Rust-only: the C ABI exposed checkpoint capture/save/load/app_state but no way to restore a process image, so the Python SDK could not reach it (Checkpoint.restore only rehydrates app_state). This PR exposes it end to end, with the same shape at every layer: restore returns a handle to the running process, and skipped-fd diagnostics are queryable off the sandbox rather than cluttering the call signature.

• Core: Sandbox::restore_interactive(&cp) now returns Result<Process<'_>> (matching popen); the process is already running on return. Fds that could not be transparently recreated (sockets, pipes, memfds, pseudo-filesystem paths) are recorded on the Sandbox as structured SkippedFd { fd, path } entries, queryable via Sandbox::restore_skipped().
• FFI: new sandlock_restore_interactive(policy, name, cp) -> sandlock_handle_t*. The restored process is already running (no sandlock_start); on failure the half-built child is reaped before returning NULL. Skipped fds are enumerated with sandlock_handle_restore_skipped_len / _fd / _path (paths are malloc'd strings freed with sandlock_string_free, lifetime-independent of the handle). include/sandlock.h regenerated with cbindgen.
• Python: Sandbox.restore_interactive(cp) -> None installs the handle so pid / pause / resume / kill / wait work on the restored process; Sandbox.restore_skipped returns the diagnostics as SkippedFd named tuples. Raises RuntimeError if the sandbox is already running or the restore fails.
• Docs: python/README.md Sandbox method reference and Checkpoint section.

Inherits the core engine limits: x86_64 only, transparent restore currently holds for vDSO-free programs.

Test plan

• New crates/sandlock-ffi/tests/restore.rs: end-to-end resume through the C ABI (checkpoint a vDSO-free counter guest, kill it, restore into a fresh handle, prove the counter advances past a sentinel), skipped-fd accessor consistency including out-of-range and NULL-handle sentinels, and a null-input case. Skips gracefully off x86_64 or without a C compiler.
• New TestRestoreInteractive in python/tests/test_checkpoint.py: the same end-to-end proof through the Python SDK, restore_skipped shape checks, plus the already-running error case.
• Core build_fd_plan unit tests updated to the structured SkippedFd shape.
• Full Rust workspace test suite (958 tests, single-threaded) and full Python suite (379 tests) pass locally.

🤖 Generated with Claude Code