test: switch /etc probe from /etc/os-release to /etc/group

[congwang-mk]

Summary

Follow-up to commit 4f9b2eb (the /etc/passwd test-leak fix), which switched the canonical "denied read" probe to /etc/os-release. That choice broke CI on Debian/Ubuntu/Fedora runners because /etc/os-release is a symlink to /usr/lib/os-release on those distros — Landlock checks the resolved file, so reads succeeded whenever /usr was in fs_read, defeating four assertions:

• test_landlock::test_cannot_read_outside_allowed
• test_sandbox::test_denied_path
• test_sandbox::test_nested_sandbox
• test_sandbox::test_nested_sandbox_via_cli

Switches every probe to /etc/group: real (never-symlinked) file on every Linux distro with users, innocuous content, and no virtualization handler in sandlock.

Test plan

• cargo test --release -p sandlock-core --test integration — all 14 affected tests pass locally
• cargo test --release -p sandlock-core --lib -- chroot::resolve procfs::tests — 21 unit tests pass
• cargo test --release -p sandlock-cli --test cli_test — CLI denied-path test passes
• CI green on Ubuntu runner

🤖 Generated with Claude Code