Guard production code against networking

[kwisatzh]

Changes

• Add a stdlib-only regression guard for production code under cmd/ and internal/, including its dependency graph. Reject HTTP/network APIs, low-level socket calls, unreviewed Cgo and subprocess-launch paths (os/exec, os.StartProcess, low-level process APIs). Parsing helpers remain allowed.
• Extend the restricted binary smoke and run it in Linux PR CI: compare actual exit status, stdout and stderr with bridge networking versus --network none for investigate (summaries and LiteLLM spend), inspect, diagnose, scan and compare.
• Build a local FROM scratch image and use the same immutable image ID for both modes. A test-only route probe confirms offline routing is denied without sending packets or depending on an external service.
• Correct the guard comment to cite this actual CI step. Update supported security fixes to 0.7.x.

Verification

• Go 1.26.9 on Darwin/arm64: go test -race -count=1 ./... and go vet ./... pass.
• 59 guard fixtures, dependency-graph checks and low-level-policy tests pass.
• sh scripts/restricted-smoke.sh <built-archive> linux/arm64: all 6 cases pass on Docker Desktop's native Linux/arm64 VM.
• The same smoke on Linux/amd64 under Docker Desktop emulation: all 6 cases pass.
• In both runs, the route probe succeeds under bridge and receives ENETUNREACH under none; all CLI outputs and exit codes match. Scan returns its expected exit 3, the other cases exit 0.
• Formatting and whitespace checks pass. Hosted Linux CI will verify the final head independently.

No production code or installer changes. The guard and smoke are regression protections for the inspected code and exercised paths, not a universal proof about every possible input or dynamic execution path.

Keep this PR in draft. The site no-network statement remains a separate follow-up after both this and site #12 merge. No release requested.