[E8-T5] State and test the gateway-bypass boundary

## Outcome

the demo distinguishes gateway policy enforcement from workload identity, network bypass prevention, and runtime isolation.

## Delivery contract

- **Parent Epic:** #12 (E8)
- **Size:** S
- **Depends on:** #36 (E4-T4), #51 (E8-T4)
- **Wave:** Wave C - Credible delivery
- **Sequence:** 805

## Acceptance criteria

- the supported environment either blocks one documented direct-egress attempt or records it as a demonstrated open gap; worker configuration still contains no long-lived provider credentials; documentation makes no stronger isolation claim than evidence supports.

## Quality gate and evidence

- G5 with the direct-egress experiment, worker environment evidence, and updated gap statement.
- Record exact commands/artifacts in the PR; prose-only confirmation is not evidence.

## Non-goal

- a comprehensive hostile-agent security certification.

## Definition of Done

- Acceptance behavior and its named negative case are observable.
- Focused checks and the repository baseline pass, or an explicit blocker is recorded.
- A teammate can reproduce the evidence.
- The change remains inside the parent Epic and architecture boundary.

No files or test entry points are named. Start by reviewing the implementation and checks for the gateway, worker configuration, direct egress, and runtime isolation, then run the direct-egress experiment and capture worker environment evidence. Done means the negative case is observable, credentials remain absent, exact commands and artifacts are recorded, and the baseline passes or an explicit blocker is documented.

Written by the indexing model from the issue text.