macOS: buzz-acp child processes cannot connect to LAN endpoints while identical Terminal process succeeds

## Summary

On macOS Apple Silicon, a Buzz Desktop 0.5.4 external ACP runtime launched through `buzz-acp` cannot establish an IPv4 TCP connection to a LAN OpenAI-compatible endpoint. The identical Python executable and `/usr/bin/curl` succeed when launched from Terminal.

The ACP protocol itself works in direct tests; the failure is in the Buzz-launched child network path.

## Environment

- Buzz Desktop: 0.5.4
- macOS on Apple Silicon
- External ACP runtime launched through Buzz via `buzz-acp`
- OpenAI-compatible endpoint: `http://192.168.1.78:11434`
- Model: `qwen3.6:35b`

## Reproduction

1. Configure one managed Buzz agent to launch a minimal external ACP runtime through `buzz-acp`.
2. From Terminal, run the same Python executable and probe `192.168.1.78:11434`; the TCP connection and HTTP request succeed.
3. Launch the same runtime through Buzz Desktop 0.5.4.
4. From the child process, resolve and connect to `192.168.1.78:11434`.
5. Repeat the connection test with `/usr/bin/curl`.

## Expected

A Buzz-launched ACP child should have the same permitted LAN connectivity as the same executable launched from Terminal.

## Actual

DNS resolves successfully to IPv4 `192.168.1.78`, but the child fails before HTTP:

```
Python:
OSError: [Errno 65] No route to host

curl:
exit code 7
HTTP status 000
Failed to connect to 192.168.1.78 port 11434
```

Both Python `socket.connect()` and `curl` fail, so this is not Python-specific. The bundled `buzz-agent` shows the same inability to reach the LAN model endpoint.

## Comparison

The Buzz child and Terminal process use:

- the same Python executable;
- the same UID/GID;
- the same HOME and TMPDIR;
- no HTTP, HTTPS, or ALL proxy variables;
- no TLS override variables;
- successful DNS resolution to the same IPv4 address.

The main observable differences are the Buzz parent process, Buzz child working directory, and Buzz-provided PATH.

The visible application entitlements did not show the standard App Sandbox entitlement. No non-privileged TCC denial was visible, so the precise macOS enforcement mechanism remains unknown.

## Request

Please verify whether `buzz-acp` child processes inherit a macOS network policy, sandbox restriction, or other launch-context limitation that blocks LAN IPv4 connections, and ensure external ACP children can reach permitted LAN HTTP endpoints.