Advisories for Cargo/Nono-Cli package

Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: ~/.config/nono/packages/lockfile.json ~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.

The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with "allow bash" policy so that it can invoke arbitrary host tools like make, gcc, etc. to write code.