Drop --unshare-net from bwrap args, no network setup yet

Without any network setup (slirp4netns or similar), unsharing the
network namespace just leaves the sandbox with no network at all,
which isn't useful yet. build_bwrap_args() now skips --unshare-net
when assembling the real bwrap invocation; re-add once network
isolation is implemented.

detect_bwrap_unshare_args() itself is unchanged and still probes/
reports net namespace kernel support (e.g. via -t/--test), since
that's capability detection, not policy -- same pattern as the
--new-session removal.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bwrap.cpp

@@ -159,6 +159,14 @@ std::vector<std::string> build_bwrap_args(const std::string& root,
     auto unshare_args = detect_bwrap_unshare_args();
     bool has_pid_ns = false;
     for (const auto& arg : unshare_args) {
+        // Not requested yet: without any network setup (slirp4netns or similar),
+        // unsharing it just leaves the sandbox with no network at all. Re-add once
+        // network isolation is implemented. (detect_bwrap_unshare_args() still
+        // probes/reports it, e.g. for -t/--test, since that's kernel capability, not
+        // policy.)
+        if (arg == "--unshare-net") {
+            continue;
+        }
         args.push_back(arg);
         if (arg == "--unshare-pid") {
             has_pid_ns = true;