Combine namespace probes with CLONE_NEWUSER

As a regular (non-root) user, most namespace types can only be
unshared together with a fresh user namespace, not in isolation --
the user namespace is what supplies the needed capabilities. Probing
each type on its own under-reported support: on this dev machine only
--unshare-user came back as supported, when in fact ipc/pid/net/uts/
cgroup were all usable once combined with it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bwrap.cpp

@@ -113,13 +113,29 @@ std::optional<pid_t> find_fuse_overlayfs_pid(const std::string& merged_path) {
 
 std::vector<std::string> detect_bwrap_unshare_args() {
     std::vector<std::string> args;
+
+    bool user_ns_supported = kernel_supports_namespace(CLONE_NEWUSER);
+    spdlog::debug("namespace user: {}", user_ns_supported ? "supported" : "not supported");
+    if (user_ns_supported) {
+        args.push_back("--unshare-user");
+    }
+
     for (const auto& probe : kNamespaceProbes) {
-        bool supported = kernel_supports_namespace(probe.clone_flag);
+        if (probe.clone_flag == CLONE_NEWUSER) {
+            continue;
+        }
+        // As a regular (non-root) user, most namespace types can only be unshared
+        // together with a fresh user namespace (which supplies the capabilities
+        // needed), not in isolation -- so combine them here whenever the user
+        // namespace probe above succeeded.
+        int flags = probe.clone_flag | (user_ns_supported ? CLONE_NEWUSER : 0);
+        bool supported = kernel_supports_namespace(flags);
         spdlog::debug("namespace {}: {}", probe.name, supported ? "supported" : "not supported");
         if (supported) {
             args.push_back(probe.bwrap_arg);
         }
     }
+
     return args;
 }