Bubblewrap and unshare /proc mount diagnostics

DIAGNOSTIC ONLY, no code change, no PR, no branch. Run these exact shell commands in your worktree and post their full output as a task comment, then finish with no_pr (no_code_needed, evidence = the output): (1) grep -E " /proc( |/)" /proc/self/mountinfo ; (2) cat /proc/self/status | grep -E "^(Uid|NSpid|CapEff)" ; (3) bwrap --dev-bind / / --unshare-pid --proc /proc -- true; echo rc=$? ; (4) bwrap --dev-bind / / --unshare-pid --dev-bind /proc /proc -- true; echo rc=$? ; (5) unshare -Urpf --mount sh -c "mount -t proc -o hidepid=invisible proc /proc && echo mounted-hidepid" ; echo rc=$? ; (6) unshare -Urpf --mount sh -c "mount -t proc proc /proc && echo mounted-plain" ; echo rc=$? ; (7) cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null; sysctl user.max_user_namespaces 2>/dev/null; bwrap --version

Ran the 7 /proc diagnostics; output is in the evidence and the report. bwrap --proc fails with EPERM, the /proc bind works, unshare -U can't write uid_map. Host /proc is mounted hidepid=invisible. No code, no PR.