shared bwrap sandbox, skip for super admin, extend to pi and terminals

- extract buildSandboxPrefix/buildRunuserSuffix into shared sandbox.ts
- super admin bypasses bwrap for full host access (claude, pi, terminal)
- member pi processes now use bwrap instead of sudo -u
- member terminals now use bwrap instead of sudo -u
- mount /run for systemd-resolved DNS inside sandbox
- pass role through claude spawn params and channel types

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/sidecar/protocol.ts

@@ -79,6 +79,7 @@ export type ClaudeSpawnParams = {
   prompt: string;
   sessionKey: string;
   model?: string;
+  role?: string;
 };
 
 export type ClaudeSpawnStreamingParams = {
@@ -89,6 +90,7 @@ export type ClaudeSpawnStreamingParams = {
   sessionKey: string;
   cwd?: string;
   model?: string;
+  role?: string;
 };
 
 export type ClaudeCodeResult = {
@@ -134,7 +136,6 @@ export type PtyInitConfig = {
   cwd?: string;
   homeDir?: string;
   userLabel?: string;
-  username?: string;
   host?: boolean;
   cols?: number;
   rows?: number;