Drop --new-session from bwrap args, breaks foreground tty

It detaches the sandboxed process from the controlling terminal, so
an interactive /bin/sh fails with "can't access tty; job control
turned off." Re-add it once background/daemonized runs land, where
detaching from the terminal is actually the point.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bwrap.cpp

@@ -125,7 +125,10 @@ std::vector<std::string> detect_bwrap_unshare_args() {
 
 std::vector<std::string> build_bwrap_args(const std::string& root,
                                            const std::vector<std::string>& command) {
-    std::vector<std::string> args = {"bwrap", "--die-with-parent", "--new-session"};
+    // --new-session detaches from the controlling terminal, which breaks job
+    // control for an interactive foreground shell ("can't access tty"). Re-enable
+    // once background/daemonized runs are implemented, where that's the point.
+    std::vector<std::string> args = {"bwrap", "--die-with-parent"};
 
     auto unshare_args = detect_bwrap_unshare_args();
     bool has_pid_ns = false;