MITM TLS/HTTP inspection runs inside the privileged VM owner process

## Problem

The internet MITM path (`crates/capsem-core/src/net/mitm_proxy`) runs inside `capsem-process`, the per-VM owner that holds the VM's security rules, plugin policy, the session `DbWriter`, the CA and minted certificates, VSOCK control, and the hypervisor handle.

That code is the most exposed parser in the product: it terminates TLS and parses HTTP/1.1, SSE, WebSocket upgrades and framed MCP from a hostile guest on one side and an arbitrary internet peer on the other. A memory-safety or logic bug there currently executes with the owner's full authority, including the audit writer and the policy snapshot it is supposed to be subject to.

The published-port path already has the right shape: `capsem-router` is a confined child (seccomp/Seatbelt, no filesystem, no dialing, parent-watch) that receives sockets by `SCM_RIGHTS` and never sees policy or the DB.

## Expected

Inspection runs in a confined child (`capsem-mitm`, one per VM) with the same confinement primitives as the router:

- streams arrive by FD passing from the owner;
- upstream dialing stays an owner-provided, narrow capability (the child cannot open arbitrary connections);
- telemetry leaves through a typed IPC sink and the owner evaluates rules and writes the ledger (fail-closed when the sink is unavailable, as `emit_security_write` is today);
- keys and minted certificates are provisioned by the owner.

## What blocks it in the code today

1. The pipeline dials upstream itself (`TcpStream::connect` in `mitm_proxy/mod.rs` and `upgrade.rs`); it needs an `UpstreamConnector` seam.
2. `TelemetryHook` writes straight to `Arc` and evaluates rules in place; it needs a `LedgerSink` seam with an in-process and an IPC implementation.
3. Shared confinement code lives in `capsem-router` and should move to `capsem-guard` so each companion carries only its own syscall allowlist.

## Proof required

- Confinement proof under the gate sandbox (same rail as the router).
- Existing MITM Kingslanding/ironbank proofs unchanged with the inspector out of process.
- Killing the inspector drops only that VM's internet traffic.

Tracked out of the networking sprint (S08 in the ledger) so the private-network work is not blocked on it.

Start with crates/capsem-core/src/net/mitm_proxy/mod.rs and upgrade.rs, then trace TelemetryHook, emit_security_write, and the shared confinement code in capsem-router. Define the UpstreamConnector and LedgerSink seams, move shared confinement to capsem-guard, and run the existing MITM Kingslanding/ironbank proofs plus the gate sandbox proof; done also requires isolated traffic loss when the inspector is killed.

Written by the indexing model from the issue text.