Egress Transform policy in 02-coding-agents omits trafficInspection: Full

## Summary

`cli/samples/02-coding-agents/gh-copilot-cli/cli/policy.yaml` sets `defaultAction: Deny` with three `Transform` rules that inject an `Authorization` header, but it does not set `trafficInspection`. The CLI egress template (`aca sandbox egress init`) sets `trafficInspection: Full` alongside `defaultAction: Deny` and Transform rules. Without Full inspection, default-deny and header transforms may not enforce.

## Evidence (aca 1.0.0-preview.1)

`aca sandbox egress schema` defines `trafficInspection` (enum: Legacy, Full, Partial, None). The `aca sandbox egress init` template ships:

```
defaultAction: Deny
trafficInspection: Full
hostRules: ...
rules: # Transform examples
```

The sample policy has the same shape (Deny + Transform) but omits `trafficInspection`.

## Fix

Add `trafficInspection: Full` to `policy.yaml`. The SDK egress path in `10-connectors-email-triage` (builder methods `set_egress_default` / `add_egress_transform_rule`) should set the equivalent. Validate by applying the policy to a sandbox and confirming the injected header arrives at an allowed host and a non-allowed host is blocked.

Start with cli/samples/02-coding-agents/gh-copilot-cli/cli/policy.yaml and compare it with the aca sandbox egress init template. Then inspect the 10-connectors-email-triage SDK path, especially set_egress_default and add_egress_transform_rule. Done means both paths set trafficInspection: Full, and applying the policy confirms the header reaches an allowed host while a non-allowed host is blocked.

Written by the indexing model from the issue text.