Virtualize sysfs to prevent host information exposure #261

Granting -r /sys exposes host hardware and topology despite the explicit block on /sys/class/net; alternative paths under /sys/devices can reveal network devices too.

Provide a read-only synthetic sysfs view consistent with the sandbox’s virtual CPU and network state. Hide unsupported entries and cover directory listings, symlinks, directory-relative access, and metadata without falling through to host sysfs.

Account for existing GPU support with narrowly scoped device views instead of broad host PCI/NVIDIA sysfs access.