Allows macOS worker commands to run kill -0 existence checks on processes outside the command, while real signals to those processes stay blocked. Linux keeps refusing the probes because Landlock has no per-signal exception, and that limit is now documented.
Adds a Seatbelt rule allowing only signal number 0 outside the worker sandbox.
Documents in docs/config.md the Linux EPERM limit and that enforcement requires Landlock ABI 6 or newer, and expands sandbox tests to cover signal-zero, TERM, STOP, CONT, and KILL probes.
Confidence Score: 5/5
The PR appears safe to merge, with no outstanding findings.
Summary
Allows macOS workers to run kill -0 checks outside their command while keeping real signals blocked.
macOS workers can check whether outside processes exist without signaling them.
