I feel like that would require work from the language side, or at least runtimes. Is there a way of stopping code in one package from, say, hitting the network?

You might be able to do this around install scripts, though disk writing is likely needed for all (but perhaps locations could be controlled).