patched sandbox policy to quit sandboxing upon SYS_exit_group()
also unified the mixed use of "machine / arch" and SandboxAction(...) / self.{_KILL_RF,_CONT}, and added `SYS_restart_syscall()`, aka., `(0, i686)` and `(219, x86_64)` into the white list.