Function try_unblock_loader_sandbox 

fn try_unblock_loader_sandbox() -> bool

Try to lift the loader’s network sandbox for the next scheduler start by writing the scheduler’s own runtime drop-in under /run/systemd/system.

The seccomp filter the loader installed is per-process and inherited: this process cannot lift its own, but systemd loads the runtime drop-in at the next daemon-reload and unit start, so the next loader-spawned scheduler gets the TCP dashboard while this run serves the unix socket. Returns true when the drop-in was actually written (the exit path then restores it).