feat: implement landlock

[C4illin]

Summary by cubic

Runs every external converter through a per-job Landlock sandbox instead of invoking tools directly, limiting each process to its input, output, and temporary directories while blocking network access. Unsupported systems fall back to unsandboxed execution by default; SANDBOX_STRICT=true makes missing sandbox support fail conversions.

Bug Fixes

• Download endpoint and archive generation now reject symlinked files.

Migration

• The Docker image now builds and installs landlock-runner with gcc and enables strict mode.
• Set SANDBOX_DISABLED=true to disable sandbox discovery or LANDLOCK_RUNNER_PATH to use a custom runner.
• Sandboxed processes now use the job directory for TMPDIR, TEMP, TMP, and HOME.
• Adds tests for runner discovery, strict-mode failures, environment propagation, and filesystem and network restrictions.

^{Written for commit b795d66. Summary will update on new commits.}