Allow disabling boolean flags from the CLI

Pair --hardened, --dry-run, and --unshare-net (renamed from --no-net)
with negation counterparts so a CLI invocation can override a truthy
config-file or profile value.

README.md

@@ -25,7 +25,7 @@ Top-level keys set defaults; `[profile.<name>]` sections define named presets se
 ```toml
 # Global defaults
 whitelist = true
-no-net = true
+unshare-net = true
 ro = ["~/.aws"]
 
 # Named profile