Function qualify_host_no_rdrand 

pub fn qualify_host_no_rdrand() -> Result<(), AdmissionRefusal>

Probe the Linux CPUID-faulting API in a child. Disabling CPUID in the tracer would also fault Rust’s and libc’s own feature detection, so only the forked child changes its state. After fork the child uses only libc syscalls and _exit, without allocation, locks or unwinding.