Move restricted egress enforcement outside the workload and record network evidence

[justsml]

This was generated by AI during triage.

Goal

Make restricted egress externally enforced and independently observable, rather than relying on a root process inside the workload to maintain iptables rules.

Scope

• Replace or minimize in-container NET_ADMIN/NET_RAW enforcement with a host-level or dedicated gateway/sidecar enforcement adapter.
• Emit durable network evidence for DNS resolutions and connection attempts, including allow/deny disposition, destination, port, policy ID, and run/tool correlation.
• Fail closed for direct DNS/proxy bypass and out-of-policy destinations.
• Preserve offline, package-egress, approved-targets, and explicitly approved full modes.

Acceptance criteria

• An approved-target workload cannot reach a non-approved host or restricted subnet.
• Network evidence distinguishes allowed, denied, and enforcement-unavailable outcomes.
• Tests cover ordinary approved traffic and bypass/restricted-destination attempts.

Dependencies

Should consume the containment-policy contract when available.

[justsml]

This was generated by AI during triage.

Implemented the first delivery in commit e3bb59a5 (harden lab egress with external controller). Restricted workloads no longer receive NET_ADMIN/NET_RAW; an external controller sidecar joins the workload network namespace and installs the allowlist/default-deny policy. The controller records policy/profile labels and rate-limited denied-packet logs.

Verified: pnpm exec vitest run tests/security-chat/lab-runtime.test.ts (25 passed) and pnpm typecheck.

Remaining scope: ingest controller/connection events into durable application Artifact rows; current forensic evidence is controller lifecycle/labels plus kernel denial logs.