no way to seal an agent's network without also sealing its model access, so no-internet tasks fall back to success criteria

[Sugarc0de]

Right now the only way I have to give a task no internet is success criteria:
a NO-INTERNET row for network clients / package managers / git verbs in Bash,
plus one for WebFetch, with check_run.py applying the zeros. That's detection
after the fact rather than a boundary, and a model with an incentive to look
something up can hide the call.

sandbox.docker.network: none would be exactly right, except the agent needs
to reach the model API from inside the container, so it isn't usable for a real
agent task.

Harbor's third mode is network_mode = "allowlist" with allowed_hosts,
enforced outside the sandbox so the agent can't loosen it from inside. The
Docker-native version would be an --internal network plus an allowlisting
proxy: no route out at all, so an agent that ignores HTTP_PROXY just fails
rather than escapes.

Smallest version that would do it for me: one mode where the only reachable
host is the model endpoint the run is already pointed at. General
allowed_hosts could come later.

Two notes:

• harbor/packager.py:687 maps two values onto Harbor's three, so this makes
  the export more faithful rather than adding a concept.
• It wouldn't replace disallowed_tools: WebSearch is served API-side, so a
  sealed container doesn't reach it.