Session containers have unrestricted network egress

This reframes #17 and should be read alongside it.

`SessionOrchestrator.cs:159-235` builds the full `podman run` argument list and passes
**no `--network` flag of any kind**. Session containers get podman's default network
with unrestricted outbound.

Combined with `console.type` being `defaultDecision: Allow`
(`surfaces/console.surface.json`), an agent holding the default grant already reaches
the entire internet by typing `curl` into its own console — no approval, no page to get
approved first, no browser involved.

## Why this matters for #17

#17 argues that the `browser` surface's command-scoped CDP interception leaves a hole
for delayed requests, and that a proxy is the fix. That is true. But the browser is not
the widest egress path while the container itself has none — the proxy would close the
second door.

`docs/release-checklist.md:139` already carries this as an unchecked item ("Per-session
network egress (nftables). Deny-by-default outbound per agent").

## What to do

Decide the order deliberately: container-level egress policy first, then #17's proxy for
per-URL granularity inside the browser. Until either exists, the claim that navigation
is the human-approved egress decision is true of the agent's browser commands, not of
the machine — say that in the release notes rather than implying more.

Found by the readiness audit, 2026-08-27.

Start with SessionOrchestrator.cs:159-235 to trace how the podman run arguments are built, then read surfaces/console.surface.json and the unchecked item at docs/release-checklist.md:139. Define and implement deny-by-default per-session egress before addressing #17's browser proxy, and update the release notes to describe the remaining navigation limitation accurately.

Written by the indexing model from the issue text.