[SaladDay]

Problem

On microsandbox, every sandbox whose egress is not fully public could not reach its model provider: the Turn failed with connection_failed. Restricted domains failed the same way over HTTPS.

Reproduced with the adapter's rule order and the v0.7.8 runtime: the SYN to the allowed domain's address passes, then the connection is reset after the ClientHello. The runtime logs TCP egress denied by strict hostname policy sni="<allowed domain>". microsandbox's strict mode, on by default, accepts a domain allow over TLS only when TLS interception can inspect the authority.

Change

The adapter sets DisableStrict. Domain allows then match by the guest's DNS answer and the TLS server name. Group, address and default-deny rules are unchanged.

Verification

Same rules, same runtime, before and after:

Probe	strict (before)	strict off (after)
HTTPS to the allowed domain, port-limited rule	reset at TLS	HTTP 404 from the server
HTTPS to the allowed domain, port-less rule	reset at TLS	HTTP 404 from the server
HTTPS to a domain not allowed	refused	refused

go vet and the adapter's network tests pass.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}