Go helper opens THP sysfs

Trap: claiming opencode-pty-client opens no paths looks correct because application code uses only inherited fd 3/4, but the Go runtime may open /sys/kernel/mm/transparent_hugepage/hpage_pmd_size before main. Fix: constrain acceptance to no application-initiated path/socket opens and enumerate permitted runtime reads, or build an artifact that satisfies the absolute syscall invariant.