- The initial `impl_rearm()` should always be performed by the
worker thread, so that we won't get spurious zero returns from
`watcher_poll()`.
- Sandboxing should not be implicitly disabled if not implemented.
- Shift internal watcher flags, to save space for public ones
if we wish to add any in the future.
- Address sanitizer may call sigaltstack().
Add it to the syscall whitelist (debug only).
- Fix args count checking for `check-bookmarkfs-util watcher`.
