[adilalperenciftci]

Summary

I found that the existing FreeBSD VM job built the toolchain and ran the portable C suite, but never executed the Capsicum/Casper enforcement driver under tests/freebsd/.

This change:

• runs the co-located portability spec in the FreeBSD VM;
• runs tests/freebsd/run.sh in the same native job, covering Capsicum entry, rights narrowing, Casper delegation, and sandboxed-child containment;
• updates stale comments and the FreeBSD test README to describe the PR gate accurately;
• keeps nightly.sh as an optional independent run and defaults it to main.

Verification

• GitHub Actions YAML parsed successfully.
• tests/freebsd/run.sh and tests/freebsd/nightly.sh passed shell syntax checks.
• Ubuntu build completed successfully.
• Portability spec: 6 passed.
• FreeBSD driver on Ubuntu: 0 failed, 4 expected platform skips, exit 0.
• Sweep discovery includes std/capsicum/test_capsicum_portability.ae.

The native enforcement result is intentionally delegated to the FreeBSD VM job added to the PR gate.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[paul-hammant]

Thanks, reviewed and folded into the batch #3456 with your authorship kept on the commit. This PR will be closed when #3456 merges.

🤖 Generated with Claude Code

[paul-hammant]

Merged as part of #3456 (merge 9364d6b), with your authorship on the commit. Thank you, @adilalperenciftci: this was a real fix, carefully tested, and it's appreciated.

🤖 Generated with Claude Code