[Ubuntu 24.04][Policy&Network] mcp add pins the single IP resolved at add time, so every MCP call to a rotating-IP host is denied with CONNECT 403

## Description

`nemoclaw mcp add --url --env KEY` generates a network policy that allows the MCP
host, but restricts it to the single IP address that the host resolved to at add time:

```
policy 'mcp_bridge_github':
- api.githubcopilot.com:443 (protocol: mcp, enforcement: enforce)
allowed IPs:
```

GitHub's MCP endpoint is served from a rotating set of addresses. Minutes later the same name resolves to a
different public GitHub address in the same range (``, differing from `` in the third
octet), the pinned entry no longer matches, and every MCP request is denied at the proxy with
CONNECT 403 — even though the server is registered, the provider is attached, the credential is ready, and the
generated policy is active.

Everything the operator can inspect looks healthy, which makes this hard to diagnose:

```
nemoclaw mcp list -> github policy provider env: GITHUB_MCP_TOKEN
nemoclaw policy-list -> ● mcp-bridge-github [user-added]
nemoclaw mcp status --json -> registryPresent/gatewayPresent/attached/credentialReady all true
```

Only one field hints at it, and it does not say why:

```
"credentialResolution": { "ok": null,
"detail": "OpenShell denied the probe connection (CONNECT 403); check the generated MCP policy" }
```

That probe is the post-add credential-resolution probe, so the pin was already stale within minutes of being
written. The MCP server is unusable from the moment it is added.

Platform scope: Ubuntu 24.04 x86_64. The failure depends on the MCP host having more than one address, so any
CDN- or anycast-backed MCP endpoint is affected.
Regression: Unknown — earlier versions not tested.

## Environment

```
Device: x86_64 server, NVIDIA A100-SXM4-40GB
OS: Ubuntu 24.04 LTS
Architecture: x86_64
Docker: 29.7.2
NemoClaw: v0.0.114
OpenShell CLI: 0.0.106
MCP endpoint: https://api.githubcopilot.com/mcp/
```

## Steps to Reproduce

```
1. Onboard a Ready sandbox.
2. Export a valid GitHub MCP token and add the managed MCP server:
export GITHUB_MCP_TOKEN=
nemoclaw mcp add github --url https://api.githubcopilot.com/mcp/ --env GITHUB_MCP_TOKEN
Note the "Effective egress that would be opened" block, in particular the "allowed IPs:" line.
3. Compare the pinned address with what the name resolves to now:
getent ahosts api.githubcopilot.com | awk '{print $1}' | sort -u
4. Ask the agent to use the MCP server for a read-only call:
nemoclaw exec -- openclaw agent --agent main \
-m "Use the configured github MCP server to look up the description of the repository NVIDIA/NemoClaw."
5. Read the status:
nemoclaw mcp status github --json
```

## Expected Result

The generated policy allows the MCP host by name for as long as the registration exists, re-resolving as needed,
so MCP calls keep working when the endpoint's addresses rotate. If an address really must be pinned, the failure
is reported as an address-pin mismatch naming the pinned and the current address, not as a generic CONNECT 403
with "check the generated MCP policy".

## Actual Result

Step 2 — the generated policy pins one address:

```
Effective egress that would be opened:
policy 'mcp_bridge_github':
- api.githubcopilot.com:443 (protocol: mcp, enforcement: enforce)
allowed IPs:
allow: initialize, notifications/initialized, ping, tools/list, tools/call,
resources/list, resources/read, resources/templates/list,
resources/subscribe, resources/unsubscribe, prompts/list
✓ Policy version 4 submitted / loaded
✓ Applied preset: mcp-bridge-github
```

Step 3 — the name no longer resolves to the pinned address:

```
getent ahosts api.githubcopilot.com ->
pinned in the policy ->
```

Step 4 — the agent cannot reach the MCP server:

```
"I attempted to use the configured GitHub MCP server (github) ... but the server appears to be offline due to
a proxy error (HTTP 403 when attempting to establish a tunnel). The network policy in this sandbox blocks
outbound connections by default, and the MCP server endpoint is not reachable at this time."

Exec failed: HTTP_PROXY= HTTPS_PROXY= http_proxy= https_proxy= \
mcporter call github get_repository owner:NVIDIA repository:NemoClaw
```

A direct probe from inside the sandbox also gets nothing:

```
curl -s -o /dev/null -w 'connect=%{http_code}' https://api.githubcopilot.com/mcp/ -> connect=000
```

Step 5 — status reports the server as present and ready, with only the probe hinting at trouble:

```
"provider": { "registryPresent": true, "gatewayPresent": true, "attached": true, "credentialReady": true,
"credentialResolution": { "ok": null,
"detail": "OpenShell denied the probe connection (CONNECT 403); check the generated MCP policy" } }
"policy": { "name": "mcp-bridge-github", "registryPresent": true, "gatewayPresent": true }
```

The same call fails identically before and after `nemoclaw rebuild --yes`, so this is not a rebuild
regression — the registration is simply unusable from the start.

## Logs

```
# add-time egress (abridged)
policy 'mcp_bridge_github':
- api.githubcopilot.com:443 (protocol: mcp, enforcement: enforce)
allowed IPs:

# current resolution
$ getent ahosts api.githubcopilot.com | awk '{print $1}' | sort -u

# from inside the sandbox
$ curl -s -o /dev/null -m 15 -w 'connect=%{http_code}\n' https://api.githubcopilot.com/mcp/
connect=000

# credential and provider state at the same moment
"attached": true, "credentialReady": true
"credentialResolution": {"ok": null, "detail": "OpenShell denied the probe connection (CONNECT 403); check the generated MCP policy"}

# for completeness: the credential itself is handled correctly - no token value appears in the add output,
# the restart output, or the status JSON (leak scans returned 0 in all three).
```