feat: add dependency status to --version and document AppArmor userns fix

Show installed dependencies, security features, and transparent proxy
availability when running --version. Detect AppArmor
unprivileged_userns restriction on Ubuntu 24.04+ and suggest the fix.
Document the RTM_NEWADDR issue in experience.md.

internal/sandbox/linux_features_stub.go

@@ -2,6 +2,12 @@
 
 package sandbox
 
+import (
+	"fmt"
+	"os/exec"
+	"runtime"
+)
+
 // LinuxFeatures describes available Linux sandboxing features.
 // This is a stub for non-Linux platforms.
 type LinuxFeatures struct {
@@ -51,3 +57,21 @@ func (f *LinuxFeatures) CanUseTransparentProxy() bool {
 func (f *LinuxFeatures) MinimumViable() bool {
 	return false
 }
+
+// PrintDependencyStatus prints dependency status for non-Linux platforms.
+func PrintDependencyStatus() {
+	if runtime.GOOS == "darwin" {
+		fmt.Printf("\n  Platform: macOS\n")
+		fmt.Printf("\n  Dependencies (required):\n")
+		if _, err := exec.LookPath("sandbox-exec"); err == nil {
+			fmt.Printf("    ✓ sandbox-exec (Seatbelt)\n")
+			fmt.Printf("\n  Status: ready\n")
+		} else {
+			fmt.Printf("    ✗ sandbox-exec — REQUIRED (should be built-in on macOS)\n")
+			fmt.Printf("\n  Status: missing required dependencies\n")
+		}
+	} else {
+		fmt.Printf("\n  Platform: %s (unsupported)\n", runtime.GOOS)
+		fmt.Printf("\n  Status: this platform is not supported\n")
+	}
+}