Method from_proto_with_pid

crates/openshell-supervisor-network/src/opa.rs:195–239

Create OPA engine from a typed proto policy with symlink resolution. When `entrypoint_pid` is non-zero, binary paths in the policy that are symlinks inside the container filesystem are resolved via `/proc/ /root/` and added as additional entries. This bridges the gap between user-specified symlink paths (e.g., `/usr/bin/python3`) and kernel-resolved canonical paths (e.g., `/usr/bin/python3.11

(proto: &ProtoSandboxPolicy, entrypoint_pid: u32)

    /// gap between user-specified symlink paths (e.g., `/usr/bin/python3`) and
    /// kernel-resolved canonical paths (e.g., `/usr/bin/python3.11`).
    pub fn from_proto_with_pid(proto: &ProtoSandboxPolicy, entrypoint_pid: u32) -> Result<Self> {
        let data_json_str = proto_to_opa_data_json(proto, entrypoint_pid);

        // Parse back to Value for preprocessing, then re-serialize
        let mut data: serde_json::Value = serde_json::from_str(&data_json_str)
            .map_err(|e| miette::miette!("internal: failed to parse proto JSON: {e}"))?;

        // Validate BEFORE expanding presets
        let (errors, warnings) = crate::l7::validate_l7_policies(&data);
        for w in &warnings {
            openshell_ocsf::ocsf_emit!(
                openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx())
                    .severity(openshell_ocsf::SeverityId::Medium)
                    .status(openshell_ocsf::StatusId::Success)
                    .state(openshell_ocsf::StateId::Enabled, "validated")
                    .unmapped("warning", serde_json::json!(w.clone()))
                    .message(format!("L7 policy validation warning: {w}"))
                    .build()
            );
        }
        if !errors.is_empty() {
            return Err(miette::miette!(
                "L7 policy validation failed:\n{}",
                errors.join("\n")
            ));
        }

        normalize_l7_policy_rule_aliases(&mut data);

        // Expand access presets to explicit rules after validation
        crate::l7::expand_access_presets(&mut data);

        let data_json = data.to_string();
        let mut engine = regorus::Engine::new();
        engine
            .add_policy("policy.rego".into(), BAKED_POLICY_RULES.into())
            .map_err(|e| miette::miette!("{e}"))?;
        engine
            .add_data_json(&data_json)
            .map_err(|e| miette::miette!("{e}"))?;
        Ok(Self {
            engine: Mutex::new(engine),
            generation: Arc::new(AtomicU64::new(0)),
        })
    }

    /// Evaluate a network access request against the loaded policy.
    ///