Outbound network policy modes, audit log and org allowlists

Self-hosted deployments set EVERRUNS_EGRESS_POLICY to open, curated-writes or curated-all. In curated-writes, plain GET and HEAD reads reach public hosts while writes, MCP and integration traffic still need the allowlist; a curated deny list applies first in both curated modes. The system allowlist grew to about 510 host patterns.

Every outbound request is logged on the everruns::egress::audit target with its decision, host, status, organization and session.

A platform administrator can let an organization extend the allowlist with up to 50 host patterns, or grant it open egress. Manage this with everruns orgs egress-allowlist.

See Network access, the orgs CLI reference and #4432, #4437, #4452, #4534.