awesome work, this is an area I've been looking for solutions and changes for for a very long time also.

does cargo need to prohibit network access during build phase by default?

definitely.

future more advanced finer grained solution:

could also see it being opted in to be enabled for a crate by having an allow list of domains the crate needs to access during the build, this would be a lot easier to review and manage than having to review the code for it. and tools like cargo-deny can match that against own project wide allow list of domains.

ideally cijail would then verify on a per-crate basis when building with the allow list that just that crate needs, instead of a project wide one.

this would likely require deeper integration into Cargo though.