pub fn restore_loader_sandbox()Expand description
Restore the loader’s network sandbox after a run that wrote the
runtime unblock. Called once from main after the run loop ends.
Idempotent (safe to call twice).
Only the byte-identical file this process wrote is ever removed: a
foreign or user-edited drop-in is logged and left untouched. /run
is tmpfs, so even an exit that skips this restore self-heals at the
next reboot.