fix: allow python fd3 reads under seccomp

[BeautyyuYanli]

Summary

• allow the Python sandbox seccomp profile to read the inherited FD 3 payload after sandbox setup
• add the descriptor metadata syscalls used by the Python FD 3 bootstrap on amd64 and arm64

Why

The Python FD 3 bootstrap introduced a regression where simple code execution could terminate with signal: bad system call after seccomp was enabled. This change restores normal execution by permitting the file descriptor operations the bootstrap now relies on.

Closes #250

This PR is drafted by gpt-5.4(high) and I'm responsible for all the changes. I have reviewed the code and varified the behavior, while breaks may still exist. Reach me to fix in this case.

Testing

• validated the updated syscall package compiles with go test -exec /bin/true ./internal/static/python_syscall
• verified the change is limited to the Python seccomp allowlists for amd64 and arm64