Enforce and disclose guest-only microVM egress

Parent: #526

Outcome

Every microVM starts with an explicitly configured go-microvm network provider and enforces the selected guest-only egress policy without affecting or misrepresenting host-side provider, MCP, WebFetch/WebSearch, hook, OCI, or telemetry traffic.

Scope

• Always configure the network provider; never rely on libkrun implicit networking.
• Reuse go-microvm's hosted provider and EgressPolicy integration.
• Close the current IPv6 parity gap by disabling guest IPv6 initially or implementing equivalent IPv6 filtering.
• Enforce deny-all and hostname/port/protocol allowlists fail-closed.
• Block host metadata, loopback, link-local, private ranges, the driver control plane, and unrelated hosted services unless explicitly required.
• Define DNS, wildcard, CNAME, rebinding, established-connection, and cache-expiry semantics.
• Surface guest and host egress posture separately in session/UI diagnostics.

Acceptance

• Failure to configure networking aborts VM creation; it never selects an implicit or allow-all fallback.
• IPv4/IPv6 literals, AAAA, DNS rebinding, CNAME, wildcard/shared-IP, DoH/DoT, metadata, link-local, fragments, and established-connection behavior are exercised against real VMs.
• Allowed destinations work and denied destinations fail from guest processes on Linux and macOS.
• Host-side network tools continue under their independent policy and are never described as covered by guest egress rules.
• Egress denials are observable without logging secret data or unbounded destination labels.