Scheduled tasks — per-fire egress allowlist

Summary

Add scoped network egress per schedule (the Cursor pattern) so a scheduled fire's outbound network calls (WebSearch, WebFetch, mcp__* tools) are restricted to an allowlist.

Part of #189 (scheduled tasks). Split out of #236 (deferred/v2) — needs network policy infrastructure, too large for the v2 finish PR (#256).

Scope

• A per-schedule EgressAllowlist []string field (domains/IP ranges).
• Enforcement at the tool execution layer (a wrapper around WebSearch/WebFetch/mcp__* that checks the destination against the allowlist before the call).
• Default: empty = no restriction (current behavior); non-empty = deny-by-default with the allowlist.
• This is the network-level analogue of the existing secret-scrubbed env + headless ask model: another unattended-safety gate.

References

• Design: #189 (Prior art: Cursor egress allowlist, Claude Routines network allowlist).
• The v2 finish: #256.

Start by reading the design and prior art in #189, then trace the scheduled-task model and the tool execution layer referenced in the scope. Done means each schedule supports an EgressAllowlist, outbound WebSearch, WebFetch, and mcp__* calls enforce it, and empty versus non-empty lists preserve the stated default behaviors.