Tracking: OpenShell 0.1.6 behaviours observed (local tracking only, nothing filed upstream) #19

For local tracking only. Nothing here has been filed upstream (not on NVIDIA/OpenShell or anywhere else). This lists OpenShell 0.1.6 behaviours seen while testing five real projects with openshell-annotate. They are not bugs in this tool, but they affect how we document and test it. Each item gets a checkbox when we have decided how openshell-annotate handles it (docs, lint hint or nothing).

• sandbox exec does not carry the image environment. PATH is reset and there is no LANG, GEM_HOME, BUNDLE_*, NODE_ENV. Scripts run with sandbox exec must export what they need.
• pidfd_open returns ENOSYS (seccomp). Breaks Ruby async / io-event epoll process waits and probably Node or Python libraries that use pidfd. Workaround for Ruby: IO_EVENT_SELECTOR=Select.
• Filesystem denials are not logged (EACCES on paths outside the allowed read set, OpenShell issue #4270). context7 failed at startup because /opt/context7 was not readable and nothing in the logs said so. Related tool issue: App directory read access is invisible to the tool and to OpenShell logs #14.
• Sandbox names are limited to 19 characters (name exceeds maximum length (21 > 19)). In our first script version this cost about 3 minutes because create exited early.
• TLS termination CA is only trusted by clients that use the system store. rustls with webpki-roots (reqwest rustls-tls with default features off), pinned certificates and some JVM truststores fail with NET:OPEN ALLOWED followed by NET:FAIL. Tool side: diff-logs does not report TLS failures after an ALLOWED connection #12.
• Loopback traffic (127.0.0.1 upstream) is not subject to the network policy and produces no events.
• Anything credential-shaped passed with --env-from prints a warning; use providers instead.

Test environment: OpenShell 0.1.6, dev server, dummy API keys only.