fix(cli): allow disabling hostname in sandbox for rootless containers

This PR introduces a new `setHostname` configuration option (and `GEMINI_CLI_SANDBOX_SET_HOSTNAME` environment variable) to allow disabling the `--hostname` argument when starting Docker or Podman sandboxes.

In rootless nested container environments, attempting to set the hostname can fail if `CAP_SYS_ADMIN` is not available in the ambient capability set. By setting `setHostname: false`, users can bypass this requirement and successfully run the sandbox in such environments.

The setting defaults to `true` to maintain existing behavior and descriptive hostnames in the CLI footer.

Fixes: #26880

cc @danielweis @tommasosciortino

docs/reference/configuration.md

@@ -1553,6 +1553,13 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `undefined`
   - **Requires restart:** Yes
 
+- **`tools.sandboxSetHostname`** (boolean):
+  - **Description:** Whether to set the hostname in the sandbox container. Set
+    to false to avoid Mutating UTS namespace, which is required for some
+    rootless container environments.
+  - **Default:** `true`
+  - **Requires restart:** Yes
+
 - **`tools.sandboxAllowedPaths`** (array):
   - **Description:** List of additional paths that the sandbox is allowed to
     access.