Envoy Proxy: Make Envoy the default network proxy backend

Goal

Flip TOOLHIVE_NETWORK_PROXY default from squid to envoy, retiring the Squid backend as the primary path for network-isolated workloads.

Prerequisites

• #5902 (Envoy backend) — merged ✅
• #5903 (hardening: digest pin, admin lockdown) — pending
• #5904 (graduate toggle to RunConfig/CLI) — pending
• Envoy e2e behavioral matrix green on Linux Docker Engine (#5917/#5922)

Tasks

• Validate Envoy on all target platforms: Linux Docker Engine, Docker Desktop (macOS), Colima, Rancher Desktop.
• Flip the default in newNetworkProxy from "squid" to "envoy" (one-line change).
• Update docs to describe Envoy as the default; document Squid as the legacy fallback via TOOLHIVE_NETWORK_PROXY=squid.
• Confirm all existing network-isolation e2e tests pass with Envoy as the default (the parametrised suite from #5917 covers this directly).
• Release note calling out the change.

Rollback

TOOLHIVE_NETWORK_PROXY=squid restores the prior behaviour without a code change.

Start at newNetworkProxy and the parametrised network-isolation e2e suite referenced in #5917/#5922. First confirm the pending Envoy hardening and RunConfig/CLI work are complete, then validate the listed platforms and update the relevant documentation and release note. Done means Envoy is the default, Squid remains available through TOOLHIVE_NETWORK_PROXY=squid, and the existing e2e tests pass.