feat(cross): --offline-strict with fail-closed network-namespace enforcement

[jwinarske]

Strengthens --offline so a build subprocess can't quietly reach the network. Builds on #98/#100.

Why

--offline denies emb's own egress (cached inputs, CARGO_NET_OFFLINE) but trusts a build subprocess — a crate build script, a CMake FetchContent — to honor it. --offline-strict removes that trust.

What

• --offline-strict (implies --offline): runs build subprocesses inside a rootless network namespace (unshare --net --map-root-user, loopback brought up), so an off-host connection is denied outright.
• Fail closed. When that isolation is unavailable — no unshare, or unprivileged user namespaces disabled (common on locked-down CI runners and in containers) — --offline-strict refuses to build rather than silently downgrading. Plain --offline degrades with a warning.
• Cargo module builds are wrapped when isolation is available; unshare inherits cwd and env, so CARGO_HOME/CARGO_NET_OFFLINE still reach cargo.

Structure

New lib/src/cross/offline_enforcement.dart: OfflineMode, the netnsWrap argv builder, a netnsAvailable capability probe, and resolveOfflineEnforcement (the fail-closed/degrade policy) — all unit-tested with a fake runner. emb cross resolves the enforcement once, before the build.

Test

• dart analyze lib test clean; dart format --set-exit-if-changed clean; cspell dictionary extended.
• New offline_enforcement_test.dart (argv wrap, probe outcomes, strict-fails-closed / deny-degrades / off-noop).
• Full suite: 507 pass, 1 skip, 2 pre-existing real dpkg-deb/real debugfs env failures.

Scope / follow-ups

• Wrapping is applied to cargo module builds; extending it to the cmake/meson module builds (via CrossBuilder) and the future hook runner is the next step.
• A seccomp/proxy-deny middle rung (below netns, above env-hints) for hosts without user namespaces.