feat(netwatch): Network/Connections agent (observe→graph→detect→consent-gated propose)

[mdheller]

Implements the one built-in agent the Agent-First Node Architecture was missing — recon (2026-08-02) confirmed the Network/Connections agent ABSENT across prophet-mesh / agent-registry / TurtleTerm / Noetica, corroborated by prophet-platform/docs/AGENT_OS_NODE_BINDING.md seam #3. Binds to existing anchors; does not rebuild.

turtle-netwatch (peer of turtle-watch / turtle-diagnose)

verb	effect
snapshot	portable connection capture — ss (Linux) / lsof (macOS/BSD)
observe	emit agent.v1 Observation events to the netwatch sink
graph	project into a System Graph subgraph (KnowledgeUpdate delta) for hellgraph AtomSpace — Process/Host/Port nodes, CONNECTS_TO edges
detect	beaconing (low-variance periodic contact) + egress fan-out anomalies
propose	build an Action (net.block/net.throttle) that is admitted-or-refused by the consent plane

The gate is real (the whole point)

A network mutation is an operate purpose in system-space. propose calls the real policy-fabric purpose_admissibility_gate:

• engine present → ADMIT → routed to the Governor (guardrail-fabric) as awaiting-governor-approval, never auto-applied (needs --apply + an approval token);
• engine absent / error → DENY fail-closed — a network mutation never proceeds ungated.

Every decision is a hash-sealed receipt. Proven both ways in tests + live (this mac: 57 real connections captured; real engine admits net.throttle, missing engine denies).

Ships as a runbook (user- and agent-executable)

runbooks/netwatch.yaml sequences the whole vertical as a turtle-runbook (turtle-runbook run netwatch) — each step a plain, inspectable command, safe to hand to an agent because every mutation is consent-gated + Governor-approved.

Also

• schemas/agent/{observation,action,knowledge_update}.avsc — the agent.v1 contracts (net-new).
• tests/test_turtle_netwatch.py — 7 tests, offline (synthetic fixtures).
• turtle-netwatch added to all packaging bin lists (flatpak/rpm/arch/deb-stage/chocolatey).

Net-new per the corpus; closes the missing built-in agent. The System Graph OS-observer collectors are the genuinely new piece; everything else binds to shipped repos.