consider disabling `run_r` rather than `abort()`ing deployment when sandbox is unavailable

[simonpcouch]

Some small percentage of systems won't be able to use either Landlock or the fallback sandbox. Right now, we just refuse to deploy in that case. One alternative is to just deploy without the run_r tool and raise a warning to the app author linking them to a help page that explains their situation. (The folks in that situation have an old Linux and have changed the default user.max_user_namespaces to 0.)

[simonpcouch]

Reactions from Codex

I think it is very reasonable, and preferable to weakening the sandbox or introducing privileged helpers.

The agent remains useful without run_r: it can search context, inspect tables, execute SQL, and call trusted calculations. It loses cross-result analysis, arbitrary statistics, and charting, but deployment no longer fails completely.

A correct implementation is moderate work—probably 1–2 focused days. The main changes are:

• Represent sandbox support as availability plus a reason, rather than aborting.
• Warn once with actionable documentation.
• Register run_r only when available.
• Avoid creating its worker and result-handle store.
• Make the system prompt conditional; it currently instructs the model to use run_r unconditionally.
• Remove tool-output messages such as:

Available to `run_r` as `r1`.

• Adjust guidance for multi-query calculations that currently says to combine results with run_r.
• Add coverage for the degraded tool set and prompt.

The existing design helps: register_handle(NULL, ...) already returns nothing, and prompt citation rules already derive from registered tools.

One caveat: the current capability check only probes Landlock availability or user-namespace creation. It does not fully exercise mounting, pivot_root(), or SELinux policy. The straightforward implementation would gracefully handle known unsupported hosts such as max_user_namespaces = 0, but not every possible later sandbox failure. A full worker preflight would make this somewhat more involved.

I would ship the straightforward version first. The warning should make the degradation explicit:

`run_r` is unavailable because this host provides neither Landlock nor
unprivileged user namespaces. The agent will deploy without R analysis
or plotting support.

Overall: good product tradeoff, low security risk, modest engineering work.