[BUG] Cowork sandbox egress proxy blocks all custom domains regardless of org allowlist config — breaks access to own infrastructure

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Claude Cowork sessions should be able to reach custom domains configured in Organization Settings → Capabilities → Code execution → allowed domains, exactly as documented. Outbound HTTPS to a domain explicitly added to that allowlist should succeed, not return connect_rejected from the egress proxy.

### What Should Happen?

Claude Cowork sessions should be able to reach custom domains configured in Organization Settings → Capabilities → Code execution → allowed domains, exactly as documented. Outbound HTTPS to a domain explicitly added to that allowlist should succeed, not return connect_rejected from the egress proxy.

### Error Messages/Logs

```shell
connect_rejected (the egress proxy denied the CONNECT (organization policy) or could not reach the destination)

curl -v output (CONNECT tunnel failed):
* Connected to 127.0.0.1 (127.0.0.1) port 40051
* CONNECT tunnel: HTTP/1.1 negotiated
* Establish HTTP proxy tunnel to :443
> CONNECT :443 HTTP/1.1
< HTTP/1.1 403 Forbidden
* CONNECT tunnel failed, response 403
curl: (56) CONNECT tunnel failed, response 403
```

### Steps to Reproduce

1. In Organization Settings → Capabilities → Code execution, enable network egress and add a custom domain to the allowed domains list (e.g. yourdomain.com).
2. Start a new Cowork session (settings only apply to new sessions).
3. Run: curl -v https://yourdomain.com
4. Expected: HTTP response from yourdomain.com.
5. Actual: request never leaves the sandbox — fails at the local proxy (127.0.0.1) with "CONNECT tunnel failed, response 403" before any DNS/TCP attempt to the target domain.
6. Also tested: raw TCP connect to the domain on port 22 — times out completely (no RST), confirming the block happens at the sandbox's egress layer, not the destination.
7. In the same session, https://github.com works normally — confirms only github.com is allowlisted regardless of the custom domain configuration.
8. This reproduces consistently across multiple sessions, multiple custom domains, after restarting the local machine and changing local network — ruling out client-side causes.

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

N/A — using Claude Cowork (cloud), not the Claude Code CLI

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

_No response_

No repository file, test, or entry point is identified. Start by reproducing the behavior with a newly configured Cowork session and curl against an allowed custom domain, then compare it with github.com. Done means the configured domain receives the HTTPS request instead of the local egress proxy returning 403.

索引モデルが issue の本文から書いたものです。