Preserve attachment Unix socket grants when controller policy is omitted

[copyberry]

Preserve attachment Unix socket grants when controller policy is omitted

Why

An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.

What changed

• Preserve omission of dangerously_allow_all_unix_sockets separately from false, and retain explicitly empty unix_sockets maps.
• Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
• Resolve omitted values to false for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
• Add debug logging for effective environment and remote execution network policies.

Testing

Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}