Fix egress/AppArmor configs found during host install

- AppArmor network rules must use socket types (stream/dgram),
  not protocol names (tcp/udp/icmp): the parser rejected the
  profile (Invalid network entry) until fixed.
- Tinyproxy has no 'Upstream none' syntax; the line failed the
  service at startup. Direct connection is the default, so the
  line is removed.
- Tinyproxy Filter is POSIX BASIC regex, not extended: the
  extended-style anchored patterns denied even allowed domains
  (verified: xcmapi.org got 403). Rewritten in basic syntax
  (\(...\)* groups); the anchored form still blocks
  evilgithub.com and xcmapi.org.evil.com (verified on host).
- Filter file must be world-readable (was 640 root:root, so
  tinyproxy could not read it and exited on reload); install
  steps now chmod 644 (documented in the filter header via
  the install note in tinyproxy.conf).
Host already runs these exact files (proxy allow/block
verified: xcmapi/github/api.github 200, example/evilgithub/
xcmapi.org.evil.com 403).

deploy/apparmor/docker-codex

@@ -26,14 +26,11 @@
 profile docker-codex flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  network inet tcp,
-  network inet udp,
-  network inet icmp,
-  network inet6 tcp,
-  network inet6 udp,
-  network inet6 icmp,
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
   deny network raw,
-  deny network packet,
 
   capability chown,
   capability dac_override,

deploy/egress/tinyproxy-filter

@@ -1,10 +1,23 @@
-# Tinyproxy Filter lines are extended regexes, matched as substrings
-# unless anchored. A bare "github.com" would also match
-# "evilgithub.com", so every entry is anchored to the domain and
-# its subdomains only.
-^(.+\.)?xcmapi\.org$
-^(.+\.)?github\.com$
-^(.+\.)?githubusercontent\.com$
-^(.+\.)?pypi\.org$
-^(.+\.)?pythonhosted\.org$
-^(.+\.)?npmjs\.org$
+# Tinyproxy Filter: ONE regex per line, matched against the bare
+# domain for CONNECT requests (the log shows e.g. filtered domain
+# "xcmapi.org" -- no scheme, no :port suffix).
+#
+# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
+# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
+# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
+# verified on 2026-10-26 to deny even xcmapi.org itself, while the
+# basic-syntax equivalent below allows it. In basic regex, groups
+# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
+# literal characters. Do NOT "modernize" these patterns.
+#
+# Each entry is anchored (^...$) to the domain and its subdomains
+# only: a bare substring "github.com" would also match
+# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
+# "label." segments, so xcmapi.org and api.xcmapi.org match, while
+# notxcmapi.org and xcmapi.org.evil.com do not.
+^\(.*\.\)*xcmapi\.org$
+^\(.*\.\)*github\.com$
+^\(.*\.\)*githubusercontent\.com$
+^\(.*\.\)*pypi\.org$
+^\(.*\.\)*pythonhosted\.org$
+^\(.*\.\)*npmjs\.org$

deploy/egress/tinyproxy.conf

@@ -45,8 +45,8 @@ ConnectPort 80
 # Allowlist: deny everything not in the filter file.
 FilterDefaultDeny Yes
 Filter "/etc/tinyproxy/tinyproxy-filter"
-# Upstream: direct (no parent proxy). The host's own egress is
-# unrestricted; only container traffic goes through this proxy.
-Upstream none
+# No Upstream directive: direct connection is Tinyproxy's default.
+# (There is no valid "Upstream none" syntax; an invalid line here
+# used to fail the whole service at startup.)
 # Do not forward proxy headers that leak container info.
 DisableViaHeader Yes