Fix os.waitstatus_to_exitcode compat for Python 3.8

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

src/sandlock/_context.py

@@ -33,6 +33,17 @@
 from ._chroot import setup_chroot
 from .policy import Policy
 
+
+def _waitstatus_to_exitcode(status: int) -> int:
+    """Convert a waitpid status to an exit code (compat for Python <3.9)."""
+    if hasattr(os, "waitstatus_to_exitcode"):
+        return os.waitstatus_to_exitcode(status)
+    if os.WIFEXITED(status):
+        return os.WEXITSTATUS(status)
+    if os.WIFSIGNALED(status):
+        return -os.WTERMSIG(status)
+    return -1
+
 # Set after seccomp confinement in the child.  Any subsequent
 # SandboxContext in this process is nested and must skip the
 # notif filter (can't install two).
@@ -263,7 +274,7 @@ def _wait_raw(self, timeout: Optional[float] = None) -> int:
             # Blocking wait — pidfd not needed
             _, status = os.waitpid(self._pid, 0)
             self._exited = True
-            return os.waitstatus_to_exitcode(status)
+            return _waitstatus_to_exitcode(status)
 
         # Event-driven: pidfd becomes readable when child exits
         if not _pidfd_poll(self._pidfd, timeout):
@@ -274,7 +285,7 @@ def _wait_raw(self, timeout: Optional[float] = None) -> int:
         try:
             _, status = os.waitpid(self._pid, os.WNOHANG)
             self._exited = True
-            return os.waitstatus_to_exitcode(status)
+            return _waitstatus_to_exitcode(status)
         except ChildProcessError:
             self._exited = True
             return -1