build: host networking (no Docker bridge/NAT on the build host)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/docker-compose.yml

@@ -3,6 +3,9 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
+      # Build host runs dockerd with bridge:none + iptables:false (PIA killswitch,
+      # no Docker NAT). Image-build RUN steps (emsdk download) use the host netns.
+      network: host
       args:
         # Single source of truth: scripts/common/versions.sh, exported into the env by the scripts
         # that drive compose (docker/build.sh, docker/shell.sh). No default -> the Dockerfile fails
@@ -10,6 +13,10 @@ services:
         EMSCRIPTEN_VERSION: ${EMSCRIPTEN_VERSION:?source scripts/common/versions.sh before docker compose}
     # Container name is auto-generated with project prefix (set in build.sh)
 
+    # The compile container shares the host network namespace so it inherits the
+    # PIA killswitch directly — the build host's dockerd has no bridge/NAT.
+    network_mode: host
+
     # Resource limits. Defaults are sized for a dev Mac (Docker Desktop VM).
     # CI overrides via env: the 32-core Hetzner runner sets KICAD_DOCKER_CPUS=$(nproc)
     # and KICAD_DOCKER_MEM=110G — with the 10-CPU default, run 27226030304 compiled