Fix egress/AppArmor configs found during host install

- AppArmor network rules must use socket types (stream/dgram),
  not protocol names (tcp/udp/icmp): the parser rejected the
  profile (Invalid network entry) until fixed.
- Tinyproxy has no 'Upstream none' syntax; the line failed the
  service at startup. Direct connection is the default, so the
  line is removed.
- Tinyproxy Filter is POSIX BASIC regex, not extended: the
  extended-style anchored patterns denied even allowed domains
  (verified: xcmapi.org got 403). Rewritten in basic syntax
  (\(...\)* groups); the anchored form still blocks
  evilgithub.com and xcmapi.org.evil.com (verified on host).
- Filter file must be world-readable (was 640 root:root, so
  tinyproxy could not read it and exited on reload); install
  steps now chmod 644 (documented in the filter header via
  the install note in tinyproxy.conf).
Host already runs these exact files (proxy allow/block
verified: xcmapi/github/api.github 200, example/evilgithub/
xcmapi.org.evil.com 403).

deploy/apparmor/docker-codex

@@ -26,14 +26,11 @@
 profile docker-codex flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  network inet tcp,
-  network inet udp,
-  network inet icmp,
-  network inet6 tcp,
-  network inet6 udp,
-  network inet6 icmp,
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
   deny network raw,
-  deny network packet,
 
   capability chown,
   capability dac_override,