[Request]: Option to prevent host access on internal networks

### Feature or enhancement request details

On `--internal` networks, the host gateway IP (e.g. `192.168.128.1`) is reachable from containers. Any host service bound to `0.0.0.0` is accessible from inside the VM. This is a concern for security-sensitive use cases like sandboxing AI coding agents, where if the agent runs as root inside the VM then it should not be able to reach the host.

### Current behavior:

- `container network create --internal` creates a network with no internet access
- The host gateway is still present on the subnet and reachable from containers
- macOS `pf` firewall rules don't seem to filter vmnet-bridged traffic
- Guest-side iptables works but is bypassable by a root process inside the VM

### Requested behavior:

A way to create a network where the host has no presence on the subnet, i.e. containers can communicate with each other but cannot reach the host. This would need to be enforced at the vmnet/hypervisor level so that it can't be bypassed from inside the VM.

### Use case:

Running autonomous AI agents (e.g. Claude Code with `--dangerously-skip-permissions`) in isolated VMs. The dual-homed proxy approach from discussion #1170 handles internet allowlisting well, but the agent VM can bypass the proxy to reach host services directly via the gateway IP. Related discussion: #719.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start with the `container network create --internal` path and the vmnet/hypervisor networking behavior described in the issue; review discussions #1170 and #719 for related constraints. Done means an internal network still permits container-to-container communication while preventing containers from reaching the host gateway, including when the guest process has root access.

Written by the indexing model from the issue text.