Align docs with real guest networking runtime

README.md

@@ -104,14 +104,21 @@ This prints bundled runtime paths, profile availability, checksum validation sta
 
 - Host-side network allocation and diagnostics are implemented.
 - The MCP server exposes `vm_network_info` for per-VM network metadata.
-- Host TAP/NAT setup is opt-in with:
+- Primary network-enabled entrypoints:
+
+```bash
+make network-demo
+make ollama-demo
+```
+
+- Network setup requires host privilege to manage TAP/NAT state.
+- The current implementation auto-uses `sudo -n` for `ip`, `nft`, and `iptables` commands when available.
+- Manual opt-in for other commands is still available with:
 
 ```bash
 PYRO_VM_ENABLE_NETWORK=1 make demo
 ```
 
-- Network setup requires host privilege to manage TAP/NAT state.
-- The current implementation auto-uses `sudo -n` for `ip`, `nft`, and `iptables` commands when available.
 - To validate real guest egress directly:
 
 ```bash
@@ -134,8 +141,6 @@ The command it asks the model to run is a small public repository clone:
 ```bash
 rm -rf hello-world && git clone --depth 1 https://github.com/octocat/Hello-World.git hello-world >/dev/null && git -C hello-world rev-parse --is-inside-work-tree
 ```
-
-If the runtime is still shim-based, the summary will show `execution_mode=host_compat`.
 By default it omits log values; to include prompt content, tool args, and tool results use:
 
 ```bash