remove CLONE_NEWNS by default (applications should do it themselves)

CLONE_NEWNS breaks running containers via podman with messages such as:

ERRO[0000] error joining network namespace for container 607b4936f51907dcf534a9d7c87ffce578611257bca9d9e05abba712e4f67ad9: error retrieving network namespace at /run/netns/cni-1aa4aa68-74d2-dacf-6b86-7bbe11a0af36: unknown FS magic on "/run/netns/cni-1aa4aa68-74d2-dacf-6b86-7bbe11a0af36": 1021994

Before this change, podman worked interactively via breakglass, but not from a
gokrazy-supervised service.

related to #44

supervise.go

@@ -417,7 +417,6 @@ func supervise(s *service) {
 			Stdout: s.Stdout,
 			Stderr: s.Stderr,
 			SysProcAttr: &syscall.SysProcAttr{
-				Unshareflags: syscall.CLONE_NEWNS,
 				// create a new process group for each service to make it easier to terminate all its
 				// processes with a single signal.
 				Setpgid: true,