`sandcat restart-proxy` orphans the running agent, breaking all networking

[maksymilianrozanski]

Summary

sandcat restart-proxy restarts the wg-client container but never recreates
the agent container that shares its network namespace.
Every connection from inside the sandbox returns ConnectionRefused /
"could not resolve host".

restart-proxy is the documented way to apply settings changes, this
breaks networking for any already-running (attached) agent on every settings
change, with no error surfaced to the user.

Steps to reproduce

1. Create and start a sandbox with a persistent agent, and attach to it:

   sandcat init        # if not already initialized
   sandcat attach      # starts wg-client + agent, opens a shell in the agent

2. Confirm networking works from inside the agent:

   curl https://github.com          # html output

3. In another terminal on the host

   sandcat restart-proxy

4. Back in the agent shell, retry the same requests:

   curl https://github.com          # curl: (6) Could not resolve host: github.com

   All networking is now broken even though wg-client and mitmproxy are
   healthy.

sandcat version 20260608.121328-b569ba4