AppArmor profile per binary path with install hint; verified network examples

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/sandbox.hpp

@@ -18,6 +18,11 @@ public:
 
     int run();
 
+    // AppArmor profile (text) that lets this very binary use user namespaces on Ubuntu 24.04+.
+    static std::string apparmorProfile();
+    // Shell command that installs it; shown when a start fails because of AppArmor.
+    static std::string apparmorInstallHint();
+
 private:
     int start(FileLock& lock);
     int watch(pid_t child, Cgroup* cgroup);