shared bwrap sandbox, skip for super admin, extend to pi and terminals

- extract buildSandboxPrefix/buildRunuserSuffix into shared sandbox.ts
- super admin bypasses bwrap for full host access (claude, pi, terminal)
- member pi processes now use bwrap instead of sudo -u
- member terminals now use bwrap instead of sudo -u
- mount /run for systemd-resolved DNS inside sandbox
- pass role through claude spawn params and channel types

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/channels/send-claude-code.ts

@@ -9,6 +9,7 @@ type ClaudeCodeParams = {
   prompt: string;
   sessionKey: string;
   model?: string;
+  role?: string;
 };
 
 type ClaudeCodeResult = {
@@ -18,8 +19,8 @@ type ClaudeCodeResult = {
   cost: MessageCost;
 };
 
-export function clearClaudeCodeSession(sessionKey: string): void {
-  sidecar.clearClaudeSession(sessionKey);
+export function clearClaudeCodeSession(sessionKey: string, email?: string): void {
+  sidecar.clearClaudeSession(sessionKey, email);
 }
 
 export async function sendClaudeCode(params: ClaudeCodeParams): Promise<ClaudeCodeResult> {
@@ -37,6 +38,7 @@ type ClaudeCodeStreamingParams = {
   sessionKey: string;
   cwd?: string;
   model?: string;
+  role?: string;
   onEvent: (event: PiEvent) => void;
 };
 
@@ -65,7 +67,7 @@ export async function sendClaudeCodeStreaming(params: ClaudeCodeStreamingParams)
 
   return {
     kill: () => {
-      sidecar.killClaude(params.sessionKey);
+      sidecar.killClaude(params.sessionKey, params.email);
       unsub();
     },
   };