feat(agent): record observed egress as http_request side effects (#465 Phase A, 3/5)

[AminChirazi]

Part 3/5 of #465 Phase A. Stacked on 2/5.

What

Every egress the supervisor admits and performs for the agent is recorded as an http_request side effect (ip:port, tcp/udp, monotonic at_ms) into a new EgressLog.observed — never touching blocked, whose emptiness is half the assert_no_egress predicate. Loopback is filtered at capture (flowproof's own proxy/MCP boundaries are already first-class trace data); AF_UNIX and denied attempts are not side effects. A destination admitted by a ${VAR}-bearing allow entry records the unresolved spelling (redaction-first when multiple entries match), the same store-unresolved rule the egress lane follows. Adds AllowSet::allow_all() and Containment::observation_only() plus the egress_engaged parameter on run_against_contained: a run supervised only for observation reports not contained (flow engages side-effect observation only; …) — the tier line never claims enforced for a wildcard policy nobody declared, and non-Linux variants early-return to the uncontained path as defense in depth.

Evidence

fmt 0 · clippy 0 · cargo test --workspace 0 · Linux cross-check 0 (includes the new Linux e2e side_effect_http_e2e.rs, runtime-proven on the Linux CI runner) · ratchets.sh exit 0, diff 396/400.

🤖 Generated with Claude Code

[AminChirazi]

CI's Linux clippy caught 8 unwrap_used warnings (promoted by -D warnings) in the new Linux-only test module — code macOS clippy never compiles, and the local cross-target gate was cargo check, which doesn't lint. Fixed to the file's .expect("…") convention; range re-measured at 397/400 and the local ratchet still passes. #471/#472 were failing only by inheritance and have been rebased.