Loaded workers share process-global host state across tenants

One use case for `celld`, as you might know, is "code mode", where agents are empowered to use code execution to chain, parallelize, or otherwise batch tool calls. One library that takes advantage of this is [Tardigrade](https://github.com/clavia-labs/tardigrade), an agent framework where tool calls are primarily done through code mode, which is JS running in a Worker Loader isolate.

Code mode essentially means arbitrary-ish code execution on a surface that isn't hardened to prevent cross-tenant shenanigans. This presents a particular challenge for `celld`. While `celld` explicitly advertises that it is "not safe for hostile multi-tenant use", we think that some cross-isolate issues are worth looking at and potentially patch.

1. **Unauthenticated internal operator listener**. Right now, some paths such as `/shutdown`, `/evict/`, `/cell/`, `/do/`, do not authenticate their callers. Therefore, a body method can `POST` to `127.0.0.1:` and to peer pods. The only way to prevent this is to disallow `EgressPolicy`, which is too coarse, and won't work on host isolates anyway. We think it would be worth considering either authenticating listeners, or implementing a destination policy for egress.

2. **Every isolate (including loaded workers) have cell-addressing ops in their globals**. `__do_call`, `__rpc_call` are installed on every isolate's globals. There's a gate (`egress_gate_request(Channel::CellRpc)`) but not on the caller identity or target cell. This means that a loaded worker can derive another session's id and RPC into it. We think a good, quick solution would be to have these ops consult `EgressPolicy` similarly to `op_fetch` or not install them on loaded workers at all.

3. **Two isolates can share the same HTTP stream**. If you have two isolates with `globalOutbound` set to `null`, the second will mint a stream id that continues the first's sequence, and operations from one can touch the other's.

No files or tests are named. Start by tracing the internal operator listener, the __do_call and __rpc_call globals, and HTTP stream-id allocation described in the issue. Before coding, narrow the scope with maintainers; done should mean an agreed isolation boundary is implemented and covered by regression tests for the affected cross-tenant behavior.

Written by the indexing model from the issue text.