[SaladDay]

An application sets the model provider base_url, and Core allowed every port of every address that host resolves to, private ones included. An application could therefore reach any intranet host from a sandbox, even with network.access = "disabled".

• Egress.Endpoints entries are now host:port and mean that TCP port on public addresses only. Core derives them from the model base_url (443 for https, 80 for http by default); loopback hosts are skipped.
• A private model host is reachable only when the operator lists its exact name in the cap's extra domains. Core then also puts that name into PrivateDomains, under every policy. A private IP-literal endpoint is not reachable.
• microsandbox: port-less private allows only for PrivateDomains names; an Endpoint becomes a tcp+port domain (or public IP) allow after deny private. Core and PrivateDomains names resolve concurrently under one 5 s deadline instead of up to 5 s each in sequence.
• E2B: a host name in allow_out only works on ports 80 and 443 (verified live), so the Core host and Endpoints on other ports also get their public IPv4 /32 addresses.
• allocationEgress fails with the lookup error when the Session is not found, instead of deriving egress from the full cap.
• Docs updated in English and Chinese, including the interim microsandbox limit on a node's Core URL host.

Tests: egress derivation (public, cap-listed private under disabled, private IP literal, loopback), microsandbox rule order, E2B allow_out for a non-443 Endpoint, and the fail-closed lookup.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}