chore(sandbox-route-helper): cite nix-rust/nix#2748 above libc::syscall fallback

Follow-up to dropped todo #60. The pre-existing section header at
`sandbox-route-helper/src/main.rs:192` (`// pidfd_open — direct libc
syscall (nix 0.29 does not expose it)`) explained that nix did not
provide a wrapper but did not point at the upstream tracker, leaving
a future reader to guess whether the gap was deliberate or whether
nix had since shipped a wrapper that nobody had wired up. Add a
single-line in-tree comment immediately above the
`libc::syscall(SYS_pidfd_open, ...)` invocation referencing
`nix-rust/nix#2748` so the libc fallback reads as a deliberate gap
pending the upstream wrapper, not an oversight.

The comment shape matches the requested template:
`// nix-rust/nix#2748: pidfd_open wrapper not yet provided; using
libc::syscall as a deliberate gap.` The pre-existing header at line
192 is left untouched — the new comment is additive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Olek

sandboxd/sandbox-route-helper/src/main.rs

@@ -206,6 +206,7 @@ fn pidfd_open(pid: i32) -> Result<OwnedFd, i32> {
     // immediately wrap in `OwnedFd` to take ownership. The flags
     // argument is 0 — the only currently-defined flag is
     // `PIDFD_NONBLOCK` (Linux 5.10+) which we don't need here.
+    // nix-rust/nix#2748: pidfd_open wrapper not yet provided; using libc::syscall as a deliberate gap.
     let raw: libc::c_long =
         unsafe { libc::syscall(libc::SYS_pidfd_open, pid as libc::pid_t, 0u32) };
     if raw < 0 {