fix(policy): harden advisor transport proposals

[johntmyers]

Summary

Add defense-in-depth guardrails that keep in-sandbox policy-advisor proposals on transport paths where OpenShell can enforce application authority. Agent-authored proposals may continue to omit protocol for the established explicit-proxy path, but they cannot request native transparent TCP or disable TLS inspection.

Related Issue

No public issue: localized defense-in-depth hardening for policy-advisor proposal authority.

Changes

• Reject agent-authored protocol: tcp and tls: skip endpoints at the sandbox-local parser and gateway submission boundary
• Preserve omitted-protocol endpoint proposals and administrator-authored native TCP policies
• Add regression coverage for rejected raw transports and accepted explicit-proxy proposals
• Update policy-advisor guidance and policy documentation
• Clarify that a native TCP hostname constrains connection routing rather than application authority, including the implications of compatible shared infrastructure

Testing

• mise run pre-commit passes
• GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=tag.gpgSign GIT_CONFIG_VALUE_0=false mise run ci passes
• Unit tests added and updated
• E2E tests added or updated (not applicable; runtime TCP enforcement is unchanged)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3136.docs.buildwithfern.com/openshell