bwrap sandbox have no escape hatches

I've previously used codex quite a bit (which also offers a bwrap based sandbox). I enabled it for `dirge` too expecting it to work in a similar way. However it seems like the sandbox is very rigid and it's not possible for the agent to ask for more permissions.

As an example I asked the model to get my WAN IP for which it used curl. As far as I understand, because of the strict `--unshare-all` there is no way for the agent to request additional permissions when operations fail.

I patched dirge to allow network within the bwrap sandbox and asked my agent to migrate a Python project from `poetry` to `uv`. It could use `websearch` to find information, but it couldn't run `uv lock` as the last step to create the lock file as that requires write access to `~/.cache/uv` where `uv` caches package downloads.

I think it would be nice to allow the agent to request running outside the sandbox and/or additional file-system write permissions/network access for specific tool calls when running with bwrap sandboxing.

The issue names no repository files or tests; start by locating the bwrap sandbox setup and the tool-call permission flow. Trace how --unshare-all, filesystem writes, and network access are configured, then define how permission requests should be represented and validated for specific calls.

Written by the indexing model from the issue text.