[SDK] Node SDK rejects network.proxy on LXC, which the backend has supported since #798

Nobody has claimed this yet.

### Relevant area(s)

Linux

### Brief description of your issue

The Node SDK rejects `network.proxy` on Linux for `containment: 'lxc'`, but LXC has supported it since #798 (iptables deny-all-except-proxy + `HTTP_PROXY` injection + `/etc/hosts` pin). The SDK gate predates that work and was never revisited, so LXC callers can't use a proxy from the SDK at all.

Gate: `sdk/node/src/sandbox.ts:350-358` allows only `bubblewrap` and `process`.
Native: `src/core/wxc_common/src/config_parser.rs:962-972` accepts `lxc`.

Two things need deciding together, since lifting the gate alone isn't enough:

1. LXC additionally requires `network.enforcementMode: 'firewall'` or `'both'` with a proxy (`config_parser.rs:1123-1137`) — native rejects `capabilities` rather than auto-promoting.
2. `SandboxPolicy.network` (`sdk/node/src/types.ts:428-445`) exposes no `enforcementMode`, so there is no way for a caller to supply it. Either the SDK promotes an unset mode to `firewall` for LXC, or `SandboxPolicy` gains the field.

The JSDoc on `SandboxPolicy.network.proxy` (`types.ts:437`) also lists only "Windows ProcessContainer, Linux Bubblewrap, and macOS Seatbelt" and needs updating either way.

### Steps to reproduce

1. On Linux, call `createConfigFromPolicy({ version: '0.6.0-alpha', network: { proxy: { url: 'http://proxy.example:8080' } } }, 'lxc')`.
2. Observe the throw.

### Expected behavior

The config is produced (with whatever `enforcementMode` the chosen fix implies), and the same policy runs on LXC with the proxy enforced.

### Actual behavior

Throws `Proxy configuration is not supported on Linux containment='lxc'. Use containment 'bubblewrap' (or the abstract 'process') for proxy-based host filtering.` - even though the executor would have accepted it.