Landlock sandboxing accepted for syscall, compile-time OTel hits v1

The syscall package is getting Landlock-based process sandboxing on Linux, with the proposal now accepted after an earlier iteration was retracted years ago. It pairs nicely with the other instrumentation story of the day: compile-time OpenTelemetry for Go has reached v1, which finally spares Go services the manual cross-cutting mess that auto-instrumented languages have avoided all along. Elsewhere, oapi-codegen 2.8.0 lands with OpenAPI 3.1, webhooks and callbacks, and a free nine-chapter Domain-Driven Design tutorial anchored to a working codebase is making the rounds for anyone who has been meaning to get past the theory.