Add bubblewrap and socat for Claude Code sandboxing (#9)

These packages are required for Claude Code's native sandboxing on Linux:
- bubblewrap: Provides filesystem isolation via Linux namespaces
- socat: Enables the network proxy for domain filtering

Without these, the /sandbox command shows installation instructions
instead of enabling sandbox mode.

Ref: https://code.claude.com/docs/en/sandboxing

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Dockerfile

@@ -9,6 +9,9 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install additional system packages (base image already includes git, curl, sudo, etc.)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+  # Sandboxing support for Claude Code
+  bubblewrap \
+  socat \
   # Modern CLI tools
   fzf \
   ripgrep \