Support restricted networking for hosted environment templates

[SaladDay]

Environment Templates and inline hosted configurations now accept a restricted network policy with exact ASCII hostnames. Core persists and resolves the complete policy, permits only narrower template overrides, preserves public request identity, and binds execution to the frozen Runtime policy. Native enforcement stays in the Codex, Claude Code and MiniMax Code adapters. Superseded peer fallback paths are removed.

The supported hosted profile is Docker V1. Unsupported hostname forms reject explicitly; E2B official self-hosted realignment and complete upstream network semantics remain outside this batch. Coverage and deployment documentation describe the supported behavior and remaining limits.

Validation:

• Complete Core make check, dedicated PostgreSQL/sqlc verification, focused policy/API/adapter tests, and actual Codex managed-process lifecycle checks passed.
• Fixed SDK 3.13.0/raw HTTP and real Kimi/MiniMax runs passed resource isolation/narrowing, system tools and Skills, Files/Artifacts, credential isolation, cancellation and owned-history recovery across the three harnesses.
• Separate real-model Docker runs passed HTTP/TLS allows, host/subdomain/redirect denials, direct-bypass checks and policy/history retention after restart. All accepted runs cleaned their resources. A transparent test-only outlet was required by the test host; this does not qualify production direct DNS/egress. Failed fixture/provider attempts and optional skipped Docker fault fixtures are documented.
• Fresh independent GPT-6 Astra high full-diff review passed with no actionable findings. The reviewer independently ran focused policy, binding, adapter, API, execution and Docker Go checks; live/full-gate evidence was inspected, not rerun.

Task: ENV-TEMPLATES-NETWORK-001. Detailed acceptance and limits: contracts/agents-api/environment-templates.md.