feat: add --learning mode, --template flag, and fix DNS relay

Learning mode (--learning) traces filesystem access with strace and
generates minimal sandbox config templates. A background monitor kills
strace when the main command exits so long-lived child processes (LSP
servers, file watchers) don't cause hangs.

Other changes:
- Add 'greywall templates list/show' subcommand
- Add --template flag to load specific learned templates
- Fix DNS relay: use TCP DNS (options use-vc) instead of broken UDP
  relay through tun2socks
- Filter O_DIRECTORY opens from learned read paths
- Add docs/experience.md with development notes

internal/sandbox/linux_features.go

@@ -36,9 +36,9 @@ type LinuxFeatures struct {
 	CanUnshareNet bool
 
 	// Transparent proxy support
-	HasIpCommand  bool // ip (iproute2) available
-	HasDevNetTun  bool // /dev/net/tun exists
-	HasTun2Socks  bool // tun2socks embedded binary available
+	HasIpCommand bool // ip (iproute2) available
+	HasDevNetTun bool // /dev/net/tun exists
+	HasTun2Socks bool // tun2socks embedded binary available
 
 	// Kernel version
 	KernelMajor int