The agent-network commands dial management directly with the profile's
WireGuard key, and the default profile config is root-owned — running
unprivileged fails reading it. Surface a clear "re-run with sudo"
message instead of a bare permission error.
Linear: NET-1399