feat: support sandbox network policies with YuanRong 0.9.7

[WenYuLuo]

Summary

This PR adds creation-time sandbox network policies to the public Python SDK and coordinates the openYuanRong 0.9.7 and sandboxd runtime changes required to enforce them.

from akernel_sdk import NetworkPolicy, Sandbox

Sandbox()  # unrestricted
Sandbox(network_policy=NetworkPolicy.block())
Sandbox(network_policy=NetworkPolicy.deny_dns("github.com", "*.github.com"))

NetworkPolicy.block() installs a stateful IPv4 default-deny policy for new flows while preserving YuanRong control and published sandbox-port routes used by direct filesystem I/O, reverse tunnels, and explicit port forwarding. DNS policies deny normalized exact or leading-wildcard names without installing a general packet allowlist.

Scope

Dependencies

• Pin openyuanrong-sandbox==0.9.7, optional openyuanrong-sdk==0.9.7, and openYuanRong tag commit 9229bbb4a0d129d10dd6aed6099f64f8fda8cf9d.
• Pin sandboxd upstream main commit 17b78468a5454ecb86b15ca0bc4f3461cb95f06a.
• Refresh the published 0.9.7 RRT and AMD64/ARM64 core-wheel checksums.

SDK and compatibility

• Add the backend-independent NetworkPolicy API and translate it through both YuanRong backends.
• Use the native local-only lifecycle close after stable-ID termination.
• Preserve deployment-configured runtime rootfs overlays for runtime-only requests.
• Forward custom reverse-tunnel ports and retain command, filesystem, tunnel, and port-forward control paths under block mode.

Deployment

• Enable sandbox ACL support in Helm, Terraform, and standalone configurations.
• Keep host kernel-module loading in node provisioning: Terraform node bootstrap and standalone host startup load br_netfilter; the node container validates the prerequisite and configures namespace-local bridge netfilter.
• Document separate iptables and bpfnat host requirements and the drained-node upgrade requirement.
• Publish standalone dynamic routes through the FunctionMaster HTTP provider so reverse tunnels remain reachable.
• Preserve the configured etcd StatefulSet service identity during in-place Helm upgrades.

Validation

• 109 Python SDK unit tests passed; Ruff and Mypy passed for all 21 SDK source files.
• Deployment shell syntax and Helm lint passed.
• GitHub Actions passed on Python 3.10, 3.11, 3.12, 3.13, and 3.14.
• openYuanRong Buildkite #239 passed all 19 jobs for the ACL/RRT integration source.
• Standalone validation passed unrestricted command, reverse-tunnel, and outbound HTTPS behavior. Under NetworkPolicy.block(), command and filesystem operations passed, the reverse tunnel returned AKERNEL_BLOCK_TUNNEL_OK, and unrelated outbound HTTPS timed out with exit code 124.
• The cluster on Huawei CCE was upgraded to openYuanRong 0.9.7. Both nodes initialized the iptables ACL backend with bridge netfilter enabled and passed the same unrestricted/block-policy SDK validation.

Commit organization

The branch is rebased on the latest main and contains five self-contained commits:

1. dependency/runtime pins;
2. SDK network-policy API;
3. resolution of the pre-existing lifecycle and custom-tunnel TODOs;
4. deployment defaults, prerequisites, and routing;
5. documentation.

Limitations

• Policies are fixed at sandbox creation.
• Packet policies currently cover IPv4.
• DNS blacklist rules cover conventional UDP/TCP DNS, not DNS-over-HTTPS or direct known-IP connections.
• block_network and dns_blacklist cannot be combined.

This PR supersedes #20.

[tianyuzhou95]

The SDK policy translation looks sound overall. I found one standalone startup blocker plus several backend-default and public-contract inconsistencies that should be addressed before merging.

[tianyuzhou95]

Before the final review, could you please rebase this branch onto the latest main and reorganize the commit history by logical category? In particular, please fold the follow-up fixes into the corresponding dependency, SDK, deployment, and documentation commits so that each commit is self-contained and the final history clearly explains the changes.

Please also update the PR title and description to match the final scope of the implementation, including the coordinated openYuanRong and sandboxd dependency updates, SDK network-policy API, deployment prerequisites and defaults, tunnel/lifecycle compatibility changes, tests, and documentation. This will make the resulting change set easier to review and maintain.

[WenYuLuo]

Addressed the final-review request:

• refreshed upstream/main; the branch was already 0 commits behind and is rebuilt directly on the latest main;
• reorganized the history into four self-contained commits: dependency/runtime pins (b2e4142), SDK API and compatibility (3b78de3), deployment prerequisites/defaults/routing (00c7847), and documentation (69fec0a);
• folded all follow-up fixes into those categories;
• updated the PR title and description to cover the coordinated openYuanRong/sandboxd updates, SDK policy contract, deployment requirements, tunnel/lifecycle/rootfs compatibility, validation, and documentation.

The reorganized tree is byte-for-byte identical to the pre-reorganization tree plus the host-module ownership fix requested in this review.

[tianyuzhou95]

The rebase, logical commit grouping, and updated PR scope look good. I have two remaining presentation/metadata requests before the final review:

1. Please wrap each commit body at approximately 72 characters, as required by the repository commit guidelines. The current four body paragraphs are each stored as a single long line (135, 201, 193, and 164 characters respectively). Please preserve the Conventional Commit titles, prose bodies, blank lines, and DCO sign-offs while rewrapping them.

2. Please remove or generalize the specific test-environment identifier Huawei CCE cn-north-4/akernel-cce from the PR description. The validation result is useful, but it can be stated as validation on a managed Kubernetes cluster without publishing the region and cluster name.

No additional functional blocker was found in the updated change set.