Add network egress allowlist guard for the HTTP client

[JE-Chen]

Security batch — close the exfiltration surface for unattended automation. Full layers + tests + EN/Zh v34 docs + README.

Feature (utils/egress, pure-stdlib)

• EgressPolicy: an allow list (default-deny — only matching hosts pass) and/or deny list of case-insensitive fnmatch host globs (*.example.com). Consulted by every http_request call — so AC_http and all features built on it are covered at once — and the host is rejected with EgressBlocked before a socket opens.
• Module-level policy starts allow-all, so there is no behavior change until an operator calls set_egress_policy. allow=None allow-all; allow=[] deny-all; deny=[...] alone blocks just those. allow/deny accept a list or comma-string (so the visual builder's text field works).
• Executor AC_egress_allow / AC_egress_check / AC_egress_reset; MCP ac_egress_*; Builder under Tools.

Verification

• 10 tests pass (allow-all default, allowlist default-deny, deny-overrides-allow, deny-only, empty-allow=deny-all, comma-string, http_client enforces before connecting, executor round-trip, wiring); existing http/assert_http tests still green; ruff clean; radon no CC≥C; bandit clean; PySide6-free.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 52 complexity · 0 duplication

Metric	Results
Complexity	52
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud