#38: Persist restricted-egress enforcement evidence

[justsml]

Split from the Wayfinder mega PR #137.

Refs #38

Scope

• Record correlated network enforcement observations through the central artifact service while keeping enforcement failures visible.

Review notes

This PR is intentionally ticket-scoped. It does not close the referenced issue unless the issue is already complete; CI provides the final integration check.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Persist enforcement-evidence failures durably and fail closed; configuration/lifecycle evidence alone does not satisfy external DNS/connection/bypass observation. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.

[justsml]

Council update after 3 review-and-repair loops:

Pushed repair commits 8351a3509, 15a4cbc3a, and 51df97789. The PR is now draft because the final gate still found P1 blockers.

Resolved:

• no restricted-workload ENTRYPOINT egress window;
• dual-stack deny enforcement and exact policy replacement;
• durable restart claim;
• pre-execution intent receipts for recognized network commands;
• controller counter-delta evidence instead of shell exit inference;
• policy CAS, idempotent evidence delivery, operator repair command, and cleanup receipts;
• current main merged without history rewrite.

Remaining P1 blockers:

1. intent admission still relies on command classification, so arbitrary socket-capable commands can bypass the pre-execution receipt;
2. execution exceptions can strand open receipts without a non-replaying terminal outcome;
3. start can publish changed enforcement metadata without reinstalling policy on an already-running lab;
4. successful cleanup repair does not reconcile the public lab runtime locator/state.

P2 follow-ups: interval-level rather than process-exclusive counter attribution, explicit counter-collection-unavailable evidence, and leased retry claims.

Verification: typecheck and formatting pass; 78 focused integration tests and 2 lifecycle tests pass. PostgreSQL and privileged Docker live enforcement remain explicit unexecuted gates.

Per the program stop rule, this PR is parked after three loops and work moves to a smaller existing PR.