docs(landlock): state the minimum kernel and Landlock ABI per feature, and name it in the hard_requirement startup error #4296

Version. OpenShell 0.1.2. Observed 2026-09-29.

Observed. With landlock: hard_requirement, a sandbox refuses to start on a kernel whose Landlock ABI is too old. The minimum kernel version and Landlock ABI per feature (path rules, truncate, network) are not documented, and the startup error does not state which ABI it needed.

Why it matters. This is the most likely first-day failure on a partner's host: the install succeeds, the first sandbox refuses, and the operator has no way to know whether a kernel upgrade will fix it or which feature to relax.

Ask.

1. Publish the minimum kernel + Landlock ABI per feature.
2. Include the required and detected ABI in the startup error.

Related: #3911 (hard_requirement permits startup when the ABI is unavailable — the inverse failure) and #4133 (doctor check should verify the Landlock prerequisite).