Document that `mcp add` egress policies are binary-scoped (node allowed, curl blocked) — debugging looks like a broken tunnel otherwise

```
Host: Windows 11 + WSL2 Ubuntu (kernel 5.15.167.4-microsoft-standard-WSL2), Docker Desktop (WSL2 backend)
NemoClaw v0.0.109 (OpenShell runtime 0.0.101) · OpenClaw 2026.7.1 (2d2ddc4) · mcporter 0.7.3 (in sandbox)
Sandbox: `retrace-pilot`, Debian GNU/Linux 13 (trixie) · Provider: ollama-local → http://host.openshell.internal:11434/v1, preferredInferenceApi openai-completions · Ollama 0.33.2 (Windows host)
Models: qwen3.5:4b (2a654d98e6fb, 3.4GB), qwen3:8b (500a1f067a9f, 5.2GB)
MCP server under test: stateless Streamable HTTP endpoint (JSON or SSE responses; GET/DELETE → 405), bearer auth
```

_Found while wiring an MCP audit server ([Retrace](https://github.com/jordandru/retrace)) into an OpenClaw agent running in a NemoClaw sandbox; the full debugging trail is in a public provenance ledger: https://retrace-api.slcwitit.workers.dev/s/sh_ea81439e010abb1c0ec7167c (events evt_20c50c96, evt_4b22e5aa, evt_f14b52db)._

**What happens**
The policy `mcp add` creates (ours: `mcp-bridge-retrace`) allows the MCP host's traffic per *binary*: the agent's node runtime passes, but `curl` from a shell in the same sandbox to the same URL is blocked. That is a defensible least-privilege design — but it is undocumented, and the natural first debugging step ("curl the endpoint from inside") fails, which reads as a broken bridge rather than a working policy.

**Repro**
1. `mcp add` any HTTPS MCP server.
2. Inside the sandbox: `curl ` → blocked.
3. Same request via `node -e 'fetch(…)'` → 200.

**Expected**
A sentence in the mcp/egress docs naming the binary scoping and the intended way to smoke-test connectivity from inside a sandbox.

Verbatim denial (OCSF sandbox log; arguably working-as-designed — the ask is documentation, not a behavior change):
[1788448602.112] [sandbox] [OCSF ] [ocsf] NET:OPEN [MED] DENIED /usr/bin/curl(80640) -> retrace-api.slcwitit.workers.dev:443 [policy:- engine:opa] [reason:binary '/usr/bin/curl' not allowed in policy 'mcp_bridge_retrace' (ancestors: [/usr/bin/dash -> /opt/openshell/bin/openshell-sandbox], …)]
At the same time the allowed path was live: [1788449944.743] … [OCSF] HTTP:POST [INFO] ALLOWED POST http://retrace-api.slcwitit.workers.dev:443/mcp [policy:mcp_bridge_retrace engine:l7-mcp] [msg:JSONRPC_L7_REQUEST decision=allow rule_methods=initialize …]

Start in the mcp/egress documentation and review the `mcp add` behavior described in the issue. Reproduce the blocked `curl` request and successful `node -e 'fetch(…)` request inside a sandbox, then document binary scoping and the intended connectivity smoke test.

Written by the indexing model from the issue text.