patched the sandbox policy to quit sandboxing earlier upon SYS_exit_group()
also unified the mixed use of "machine / arch" and SandboxAction(...) / self.{_KILL_RF,_CONT}