Add kernel namespace detection for bwrap integration

Add detect_bwrap_unshare_args(), which probes the running kernel for
which namespace types (user, ipc, pid, net, uts, cgroup) can actually
be unshared and returns the matching bwrap --unshare-xxx flags. Each
probe forks a throwaway child to call unshare() so the calling
process's own namespaces are never touched. Needed because the target
device (Android, stock kernel) only supports a subset of namespace
types, so bwrap must be invoked with just the flags it can honor.

Temporarily wired into -t/--test so it can be exercised on-device
ahead of the real bwrap invocation; will be removed once that lands.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bwrap.h

@@ -0,0 +1,27 @@
+// Copyright (C) 2026 Viorel Munteanu
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+#pragma once
+
+#include <string>
+#include <vector>
+
+// Probes the running kernel for which Linux namespace types can actually be
+// unshared and returns the corresponding bwrap --unshare-xxx flags for the
+// ones that are supported. Intended for kernels with partial namespace
+// support (e.g. stock Android kernels), where blindly passing every
+// --unshare-xxx flag to bwrap would make it fail outright.
+std::vector<std::string> detect_bwrap_unshare_args();