#2 Linux sandbox finish: CI x86_64+aarch64, mutation rows, aarch64 traces, docs/sandbox.md

Finishes Linux worker confinement: two Linux CI legs, the aarch64 syscall trace job, mutation rows for each layer, and docs/sandbox.md. Draft, to run CI only.

---

Summary by cubic

Completes Linux worker confinement: CI now runs worker tests on both x86_64 and aarch64, a new job traces the native aarch64 release worker, mutation rows cover each Linux confinement layer, and docs/sandbox.md documents the limits per OS.

• The aarch64 leg skips the mutation runner; Linux tests require a visible /proc.
• The new docs page reduces to a test that fails if a stated limit is dropped.