Change --unshare-net skip logic to trigger whenever filterProxy is set, not just for wildcard allow configs. The filtering proxy always listens on host 127.0.0.1 and requires sandboxed processes to reach the host network via env-var-based proxying. Also upgrade golangci-lint-action to v7.