fix(policy): harden landlock.compatibility validation

[letv1nnn]

Summary

1. Invalid compatibility values (e.g. hard-requirement) were accepted without error and silently treated as best_effort. Fixed by parsing into an enum at YAML parse time and TryFrom implementation at the proto conversion layer.
2. hard_requirement with no filesystem paths configured was a silent no-op, Landlock skipped entirely. Fixed by erroring before the early return when hard_requirement is set and both path lists are empty.

Related Issue

closes #2356

Changes

Two fixes to landlock.compatibility enforcement. Invalid values now fail at YAML parse time instead of silently falling back to best_effort. Configuring hard_requirement with no filesystem paths now aborts sandbox startup instead of skipping Landlock entirely. Docs updated to reflect the new behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.