[SaladDay]

• E2B closed mode: IP literals are allowed only as global /32 (or /128); host names stay names; private literals get nothing; deny_out also closes IPv6 (::/0)
• Docs (EN + zh): per-Provider restricted-network differences in environments.md, E2B IPv6/literal rules in sandbox-provider.md
• Fix the NetworkSupport.PrivateDomains comment
• Bump node wire 10, microsandbox helper 9, E2B helper 3 (Egress gained in Enforce the sandbox network cap #888); regenerated E2B contract projections and fixtures
• Create path derives egress from the reserved allocation's specification
• Web: network domains are lowercased when parsed instead of rejected
• Model base_url ports outside 1-65535 no longer become Endpoints
• deploy/node/distribution.py Docker helpers still have callers (deploy/install-source.py), kept; only the stale node-installer paragraph in deploy/node/README.md changed

Checks: go vet and go test for sandbox/..., execution (Egress/Network), cmd/server, cmd/sandbox-node; E2B helper unittests (SDK env); NetworkSettings vitest; website translations test.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}