Stop sandboxing remote shells

tests/release_scripts.rs

@@ -20,13 +20,29 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
 }
 
 #[test]
-fn systemd_sandbox_allows_netlink_for_terminal_tools() {
+fn systemd_service_does_not_sandbox_remote_shells() {
     let service = include_str!("../packaging/systemd/dosh-server.service");
     let install = include_str!("../install.sh");
     for raw in [service, install] {
+        assert!(raw.contains("KillMode=process"));
+        for directive in [
+            "NoNewPrivileges=",
+            "PrivateTmp=",
+            "ProtectSystem=",
+            "ProtectHome=",
+            "RestrictAddressFamilies=",
+            "RestrictRealtime=",
+            "LockPersonality=",
+            "MemoryDenyWriteExecute=",
+        ] {
+            assert!(
+                !raw.contains(directive),
+                "dosh sessions are user shells; systemd sandbox directive {directive} changes terminal/app behavior"
+            );
+        }
         assert!(
-            raw.contains("RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK"),
-            "dosh sessions must allow AF_NETLINK so tools like btop can enumerate network interfaces"
+            !raw.contains("ReadWritePaths="),
+            "remote shells must not be restricted to dosh config/data paths"
         );
     }
 }