fix(module_host): grant Landlock access to IPC socket path

Out-of-process modules timed out with "did not report ready within 45s"
because apply_sandbox never allowed the child to reach breadd's Unix
socket. Path-based AF_UNIX connect is mediated as filesystem access, so
without a rule for the socket (and its parent) UnixStream::connect failed
with EACCES and the hello handshake never completed.

Pass socket_path into apply_sandbox and add baseline ReadDir/ReadFile
rules for the socket directory and path, matching the existing module-
directory grant. Update unit-test call sites accordingly.

graphify-out/cost.json

@@ -0,0 +1,18 @@
+{
+  "runs": [
+    {
+      "date": "2026-08-04T09:09:09.071813+00:00",
+      "input_tokens": 0,
+      "output_tokens": 0,
+      "files": 55
+    },
+    {
+      "date": "2026-08-04T09:28:29.057021+00:00",
+      "input_tokens": 72759,
+      "output_tokens": 0,
+      "files": 55
+    }
+  ],
+  "total_input_tokens": 72759,
+  "total_output_tokens": 0
+}