Function decide_net 

pub fn decide_net(
    network_enabled: bool,
    has_domain_rules: bool,
    net_available: bool,
) -> NetDecision

Decide what to do about NETWORK confinement for one subprocess spawn. Pure — net_available is the caller’s real probe result (netns_available on Linux). Never gates on escalation (see NetDecision’s doc comment) — a network gap is always a warn, never a refuse, so this needs no approval handler at all.