Per-child network namespace + macvtap setup

[WaylandYang]

Problem

Restored children currently share the host network namespace (effectively no isolation). Need per-child netns + tap + IP.

Day 4 work from WEEK1.md.

Approach

• For each child: ip netns add child-N.
• macvtap inside the netns, attached to host iface.
• Configure firecracker /network-interfaces/eth0 to use it.
• Combines with MAC / IP hot-patch for restored children #1 (MAC patch) for full per-child identity.

Acceptance

• forkd fork --tag demo --n 10 --network produces 10 children with 10 distinct IPs
• Each child can reach the internet through host NAT