#2468 fix(sycl): permit Level Zero IPC in expert-parallel containers

说明

Expert parallelism in #1798/#2205 fails during Level Zero IPC handle import in a container using Docker's default seccomp profile. Both cards report peer access available, but cross-card and self-import return `ZE_RESULT_ERROR_INVALID_ARGUMENT` (`0x78000004`).

Add `--cap-add SYS_PTRACE` only when `--expert-parallel-device` is present. This permits the relevant syscalls under Docker's existing capability-dependent seccomp rules. The default profile remains enabled, and ordinary layer-split launches receive no extra capability. Document the option for custom launchers. This is a launcher prerequisite for the open EP PRs, with no engine feature copied into this branch.

Validation on two Intel Arc Pro B70s, kernel 7.1, Compute Runtime 26.22.38646.4, Level Zero 1.28.2, oneAPI 2026.1:

- Default container: all eight imports fail (cross-card and self, cold and warm allocations, both directions).
- SYS_PTRACE only, default seccomp retained: all eight imports succeed.
- Seccomp-unconfined only: all eight imports succeed; this broader option is not used in the patch.
- Full EP model with the capability: all 24,576 experts resident, 768 generated diagnostic tokens, zero peer-row mismatches; deterministic concurrent arithmetic, reasoning, and a tool round trip pass.
- Normal teardown, per-card health, and ten compiled two-rank all-reduces pass.
- `bash -n` and mocked Docker argv checks pass for layer-split and EP paths, including a model path containing spaces.

The exact blocked syscall was not traced. Local launcher measurements use the same conditional capability; the upstream wrapper's argument construction was checked with a mock Docker executable.