bwrap --unshare-net fails with "loopback: Failed RTM_NEWADDR"

### Description

bwrap --unshare-net fails with "loopback: Failed RTM_NEWADDR".

This makes it impossible to create network-isolated sandboxes inside a gVisor with stock bubblewrap, including running coding agents that do that, so it needs to be supported.

### Steps to reproduce

Inside gVisor running the debian:stable container image, run `bwrap --ro-bind / / --unshare-net /bin/true`

### runsc version

```shell
$ runsc --version
runsc version release-20260608.0
spec: 1.2.1
```

### docker version (if using docker)

```shell

```

### uname

_No response_

### kubectl (if using Kubernetes)

```shell

```

### repo state (if built from source)

_No response_

### runsc debug logs (if available)

```shell

```