## What changed
Add `create_command_args()` to encode argv, permissions, policy cwd, and optional managed network context through the existing bounded environment transport.
For managed networking, generate a policy that allows IPv4 and IPv6 loopback while denying direct non-loopback egress and general inbound access. Require nonempty, nonzero proxy ports and reject `allow_local_binding=false` at both launcher and policy boundaries because native host-loopback access is bidirectional.
Document the MXC launch contract, platform requirements, and limitations.
## Testing
Add portable tests covering managed network transport and policy translation, plus rejection of missing proxy ports, zero ports, and unsupported local-binding restrictions at both boundaries.
GitOrigin-RevId: 8d31b98f94a2ba3769369aa50de8e53dc143bac4
2c9e1a5775