fix(axnoded): enforce deny-all network isolation

[rcyw]

Root cause

Python SDK correctly sends a present empty strict policy; controld canonicalizes and persists it as isolated. Axnoded nevertheless attached the ordinary host interface. Because deny-all correctly omits egressd, outbound HTTPS remained possible.

Change

An isolated Allocation no longer acquires the host network interface, leaving its runsc OCI network namespace private and unconnected. Node startup rejects any accidental connected binding. No DNS-only workaround, public API change, or weaker assertion.

Reproduction and acceptance

• Released v0.11.3, public Python SDK on native linux/amd64 local stack: deny-all Run run-9051f5e6-900c-46d9-9611-53407bde527d, Allocation alloc-94081338-98bb-42da-a045-3b42802fe3a3 received external HTTPS 200; unrestricted control also received 200.
• Candidate 5cbd368d9ecdc40435b7c5fed18199fc6a363547, native linux/amd64 source Compose node image ID sha256:795c63c34ee5a5deaeda67b01bf45f993488ad54d5a7311e36558c5339f41c34. A pinned local TLS/HTTP fixture provides actual HTTPS 200 outside the sandbox without relying on public DNS. Deny-all Run run-ffbd9b14-1327-429a-bb73-dfd90c7b17bb / Allocation alloc-e17aa6e0-0385-4c11-aaea-b77dd8f3e0a7 had HTTPS=false and direct-IP TCP=false. Unrestricted Run run-a919d192-cadf-4039-a48f-6daa866393b7 / Allocation alloc-454d3a26-a3fc-4863-adf8-97918e9ed773 had HTTPS 200 and direct TCP=true.
• Both Runs used fresh Allocation identities, reached terminal success, sealed declared outputs verified against manifest SHA-256; the test Environment was deleted. Node inventory after acceptance: zero active/running Allocations and zero running containers. TLS fixture left no listener or temporary files. The task-owned source Compose stack was shut down.
• The same public SDK E2E passed on local source Compose/OrbStack; targeted Go race, Python/Go tests, Forge domestic accelerated changed gate and native Linux network-policy smoke passed.

Verification boundaries

The full local Mac gate stopped at the unrelated source Compose DNS doctor fixture issue #182, after the #181 E2E was separately run and passed. The HK host changed profile could not finish proto-generated-check because that host lacks protoc; its generated-file deletions were restored. PR required CI is the remaining gate. Do not infer broader capacity/qualification from these functional tests.

Related: #181. Keep Draft until required CI is complete and reviewed; no merge or release in this task.

[rcyw]

Rollout boundary: the enforcement change applies when a fresh Allocation is created. A pre-fix Allocation with an already attached interface is not made safe merely by upgrading axnoded in place; operators must cancel/recreate any still-running deny_all Allocation before considering the node remediated. The native acceptance above used fresh Run/Allocation identities and does not claim retroactive repair of old runtime instances.