Survive a stopped dockerd; report unexpected failures

- no docker0 yet (dockerd is socket-activated and starts on first use): fall back to the
  default gateway instead of exiting silently under pipefail
- an ERR trap in the main process prints file, line and command of an unhandled failure
- egress layers list returns success when the last layer is absent
- drop the stale OCSB_EGRESS_BASE from the settings list (broke `config`)

bin/opencode-sandbox

@@ -2,7 +2,10 @@
 # opencode-sandbox — run OpenCode 2 for a project inside a sandbox:
 #   egress filter (squid in a container) + netlock (nftables by group) + bubblewrap.
 # See README.md. Start with: opencode-sandbox help
-set -euo pipefail
+set -Eeuo pipefail
+# A failure nobody handled: say where, instead of exiting silently. Main process only: in
+# subshells ($(...), <(...)) a non-zero status is the parent's to judge
+trap '[[ ${BASHPID} != "$$" ]] || echo "opencode-sandbox: unexpected failure at ${BASH_SOURCE[0]##*/}:${LINENO}: ${BASH_COMMAND}" >&2' ERR
 
 OCSB_HOME="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
 export OCSB_HOME