boot: enable fanotify in the guest kernel

[CMGS]

Problem

x86_64_defconfig (the base of the guest kernel, see boot/Dockerfile) leaves CONFIG_FANOTIFY off, so fanotify_init() returns ENOSYS inside every sandbox. Userspace file monitors that rely on it cannot start. Seen with an OSWorld task whose anti-cheat save-file watcher opens a fanotify group; probed in a desktop guest on kernel 6.18.37 as root, as a regular user and via sudo:

python3 -c 'import ctypes,os; libc=ctypes.CDLL("libc.so.6",use_errno=True); fd=libc.fanotify_init(0x3, 0); print(fd, os.strerror(ctypes.get_errno()))'
-1 Function not implemented

Change

One line in the kernel fragment: CONFIG_FANOTIFY=y. Notification-only fanotify (no FANOTIFY_ACCESS_PERMISSIONS) is software-only: no boot-time cost, no work without a listener, a few tens of KB of kernel text.

Verification

• The fragment is applied by merge_config.sh in the boot image build; the CI boot build carries it.
• After the next boot image lands, the probe above must print a non-negative fd inside a guest; the OSWorld task that motivated this (its watcher marks a directory with FAN_MODIFY|FAN_CLOSE_WRITE) runs its setup to completion.

Hot path: none (kernel build-time option).

[CMGS]

Kernel build evidence: build-boot run https://github.com/cocoonstack/sandbox/actions/runs/34965616560 (this commit on top of #190, since a dispatched build needs that input fix) is green on amd64 and arm64. The amd64 boot/vmlinuz-sandbox it produced carries the fanotify code: strings on the kernel lists fanotify_mark and 57 other fanotify symbols, absent from the current kernel.