kernel: capsicum isstillinsanbox rework path walking