[§9.2] Single-exit egress.proxy + DLP

[mdheller]

Agentic-Stack §9 action 2 (Exodus). Route all Internet egress through egress.proxy (mTLS, domain allowlist, DLP/PII scanning, rate/budget caps); default-deny verified by smoke suite. Relates SEAM-004/005. Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).