Add fanotify fallback for WSL support

[navanchauhan]

Summary

• defer LSM backend selection until startup and fall back to fanotify when BPF LSM is unavailable
• enforce file-open and exec policies through fanotify while preserving shared log events for the UI
• join the target PID namespace from leashd so the fallback can mark /proc/1/root

Testing

• go test ./internal/lsm ./internal/leashd ./internal/runner
• make build
• LEASH_IMAGE=leash:local-wsl2 make docker-leash-prebuilt