Add --hostname to set the sandbox's hostname under -r/--run

Long-option only. Threaded through run_container() into
build_bwrap_args(), which passes it as bwrap's own --hostname only
when --unshare-uts is actually among the flags being given to bwrap
(bwrap itself refuses --hostname without it) -- otherwise logs a
warning and leaves the hostname alone, since a stock Android kernel
in degraded mode may not support a UTS namespace at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

src/bwrap.h

@@ -55,11 +55,14 @@ struct ResolvedUser {
 // in volume_mount.h). If `user` is set, the command is wrapped so it drops to that
 // uid/gid before running -- see run_bwrap() for how, since bwrap's own --uid/--gid
 // require --unshare-user, which isn't requested when running as root (see
-// detect_bwrap_unshare_args()).
+// detect_bwrap_unshare_args()). If `hostname` is set and the kernel supports
+// --unshare-uts (bwrap refuses --hostname without it), passes it as bwrap's own
+// --hostname; otherwise logs a warning and leaves the sandbox's hostname alone.
 std::vector<std::string> build_bwrap_args(const std::string& root,
                                            const std::vector<std::string>& command,
                                            const std::vector<ResolvedVolumeMount>& volumes,
-                                           std::optional<ResolvedUser> user);
+                                           std::optional<ResolvedUser> user,
+                                           const std::optional<std::string>& hostname);
 
 // Runs bwrap against `root` (the merged mount path from mount_layer()) in the
 // foreground and waits for it to exit. If `use_nsenter` is true, first locates the
@@ -71,6 +74,9 @@ std::vector<std::string> build_bwrap_args(const std::string& root,
 // (observed on kernels older than 4.18, per fuse-overlayfs's own release notes).
 // If `user` is set, this process's own binary is bind-mounted into the sandbox and
 // used to drop privileges to that uid/gid before running `command` -- see
-// build_bwrap_args(). Returns bwrap's exit code, or -1 on failure to launch.
+// build_bwrap_args(). `hostname`, if set, is forwarded to build_bwrap_args() --
+// see there for when it does/doesn't take effect. Returns bwrap's exit code, or -1
+// on failure to launch.
 int run_bwrap(const std::string& root, const std::vector<std::string>& command, bool use_nsenter,
-              const std::vector<ResolvedVolumeMount>& volumes, std::optional<ResolvedUser> user);
+              const std::vector<ResolvedVolumeMount>& volumes, std::optional<ResolvedUser> user,
+              const std::optional<std::string>& hostname);