v0.7.1: allow network inside the run_shell sandbox

Landlock no longer handles TCP, the Seatbelt profile drops (deny network*),
and the seccomp filter stops refusing IPv4/IPv6 sockets. Sandboxed commands
run without asking in auto mode on every backend (Low-IL no longer asks for
network commands), and connection errors are not treated as sandbox blocks.

include/cst_sandbox.h

@@ -2,20 +2,19 @@
 #define CST_SANDBOX_H
 
 /*
- * OS sandbox for run_shell: reads and exec stay allowed everywhere, writes
- * are limited to the workspace, the temp dir, /dev/null and /dev/tty, and
- * the network is cut where the OS can do it.
- *   Linux   Landlock (network needs ABI 4, kernel 6.7+)
+ * OS sandbox for run_shell: reads, exec and the network stay allowed;
+ * writes are limited to the workspace, the temp dir, /dev/null and /dev/tty.
+ *   Linux   Landlock
  *   Linux   seccomp user-notify when Landlock is missing (Android/Termux,
  *           older kernels): a supervisor thread checks the path of every
- *           write-type syscall and IPv4/IPv6 sockets are refused. Guards
+ *           write-type syscall. Guards
  *           against mistakes, not hostile code (the path is checked before
  *           the kernel reads it again).
  *   macOS   sandbox_init (Seatbelt profile)
  *   Windows Low integrity level: a restricted token (no admin privileges,
  *           Low IL) can only write objects labeled Low, so the workspace and
  *           a temp dir get that label; the credentials file is labeled
- *           no-read-up. The network stays open (callers ask first).
+ *           no-read-up.
  *   other   none: callers fall back to rule-based approval
  */
 
@@ -42,7 +41,7 @@ int cst_sandbox_probe(void);
 int cst_sandbox_reprobe(void);
 /* "landlock" | "seatbelt" | "seccomp" | "lowil" | "none" */
 const char *cst_sandbox_name(int kind);
-/* Landlock ABI version (0 when unavailable); ≥4 also blocks TCP. */
+/* Landlock ABI version (0 when unavailable). */
 int cst_sandbox_landlock_abi(void);
 
 typedef struct {
@@ -69,7 +68,7 @@ int cst_sandbox_run_shell(const char *workspace, const char *cmd,
                           size_t max_out, os_run_result_t *r);
 
 /* Output of a failed sandboxed run that looks like the sandbox got in the
- * way (EACCES / EPERM / EROFS / blocked network). */
+ * way (EACCES / EPERM / EROFS). */
 int cst_sandbox_blocked(const char *out, size_t n, int exit_code);
 
 /* lowil: directories this user's cst-agent labeled Low (recorded in the

include/cst_version.h

@@ -3,7 +3,7 @@
 
 #define CST_VERSION_MAJOR 0
 #define CST_VERSION_MINOR 7
-#define CST_VERSION_PATCH 0
+#define CST_VERSION_PATCH 1
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)