Drop --unshare-net from bwrap args, no network setup yet

Without any network setup (slirp4netns or similar), unsharing the
network namespace just leaves the sandbox with no network at all,
which isn't useful yet. build_bwrap_args() now skips --unshare-net
when assembling the real bwrap invocation; re-add once network
isolation is implemented.

detect_bwrap_unshare_args() itself is unchanged and still probes/
reports net namespace kernel support (e.g. via -t/--test), since
that's capability detection, not policy -- same pattern as the
--new-session removal.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -35,6 +35,11 @@ Source layout (all under `src/`):
 - `bwrap.{h,cpp}` — `detect_bwrap_unshare_args()` probes the kernel (via a forked
   `unshare(2)` per namespace type) for which `--unshare-xxx` flags `bwrap` can actually
   use; `build_bwrap_args()`/`run_bwrap()` assemble and run the sandboxed command.
+  `build_bwrap_args()` deliberately drops `--unshare-net` from what's actually passed
+  to `bwrap` even when the kernel supports it — without any network setup (e.g.
+  `slirp4netns`), unsharing it just leaves the sandbox with no network at all. Re-add
+  once network isolation is implemented; `detect_bwrap_unshare_args()` itself still
+  probes/reports it (e.g. via `-t/--test`), since that's kernel capability, not policy.
   Never requests `--unshare-user` when running as root: root doesn't need a fresh
   user namespace for privilege, and bwrap's own single-mapping uid/gid setup for one
   triggers the kernel's unprivileged-userns setgroups() restriction, which showed up