Allow disabling boolean flags from the CLI

Pair --hardened, --dry-run, and --unshare-net (renamed from --no-net)
with negation counterparts so a CLI invocation can override a truthy
config-file or profile value.

tests/integration.rs

@@ -112,8 +112,8 @@ fn ssh_dir_is_hidden() {
 }
 
 #[test]
-fn no_net_blocks_network() {
-    let output = sandbox(&["--no-net"])
+fn unshare_net_blocks_network() {
+    let output = sandbox(&["--unshare-net"])
         .args([
             "--",
             "bash",