Add --publish: the one ingress control

Everything else in the file gates egress, which left an everyday request unanswered: the
agent starts a dev server inside the sandbox and a human wants to look at it. This puts a
listener on the host that forwards into the container, so a browser, curl or an API
tester reaches the server the sandboxed process runs.

`--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the
cost named in the flag: it is ingress, so whatever that server serves is reachable from
the address it binds. The default address is 127.0.0.1 because a bare podman -p binds
every interface (measured) -- a port committed in a repo config must not quietly be a port
on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback
address warns on every run. The grammar is smaller than podman's on purpose: one port per
entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing
0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused
rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints).

Fail closed, as elsewhere: --net none cannot forward a port and podman discards the
mapping while starting the container anyway, so "it ran" would mean "nothing is
listening"; a host port already in use is named before the container starts, not after a
build; pick_port() will not hand the gate a port this run publishes. The container is
labelled with the ports it was given, and doctor reports them.

Inside, publish_rules() accepts tcp on the published ports in the input chain and never
the output one. Measured (docs/networking.md): pasta delivers the connection over
loopback, so that rule counts 0 packets on the reference host; it is there for a host or a
bridge network that delivers on the interface, and so that `nft list table inet aisb`
answers "what can reach this container". The ports are validated again inside the
entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the
measurement that makes a configured preview look broken: a server bound to 127.0.0.1
inside answers inside and refuses the published port outside, so dev servers must bind
0.0.0.0 -- both skills say so in the change that writes the port.

Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag
precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the
flags reaching the invocation before the image, egress enforcement byte-identical with a
port open, which chain the rule lands in and that a non-numeric port never reaches nft as
code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host
gets its 200 and the same run still refuses a domain outside the allowlist at 403, the
server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host
listener is gone when the container exits.

LLM-Generated: true

AGENTS.md

@@ -16,6 +16,13 @@ read-only with no escape hatch (`agents`/`--agents`/`--agents-dir`, and `--no-ag
 a sandbox that could write your skills could write instructions you follow later on the
 host. See `agents_src_of()` and the tests in `tests/unit/09_agents.sh` / `tests/e2e/12_sandbox.sh`.
 
+There is exactly one **ingress** control: `--publish` / `publish` forwards a host port into the
+container so a server the sandbox runs can be previewed from the host. It binds `127.0.0.1` unless the
+spec names an address (measured: podman's bare `-p` binds every interface), takes one port per entry,
+refuses to start under `--net none` rather than run with nothing listening, and the in-container
+ruleset names the ports it opened. It changes nothing about egress — the same run that answers a
+browser still refuses every domain outside the allowlist (`tests/e2e/13_publish.sh`).
+
 There is a second program, `bin/ai-sandbox-autophase`: the driver for a
 `.agents/phases/` pipeline. It runs every executor agent *and the `.agents/validate.sh`
 gate* through the sandbox, and does the commits and pushes on the host — the git remote
@@ -139,6 +146,19 @@ networking or the image, `make e2e` green too.
   so it is written on the *first* seed too, not only by the merge on the second run.
 * `split_target()` / `classify_allows()` — the mapping from what the user typed to
   what the firewall and the proxy enforce.
+* `resolve_publish()` / `publish_rules()` — the one ingress path, whose two ends have to agree: the
+  canonical `addr:host:container` spec built on the host, and the container-side accept rule rendered
+  from `AISB_PUBLISH_PORTS`. Three things are load-bearing. (1) The bind default is loopback — widen
+  it and a preview in a committed config becomes a listener on the LAN, which is the mistake the flag
+  exists to avoid. (2) The rule belongs in the `input` chain and never the `output` chain;
+  `tests/unit/06_entrypoint.sh` asserts which chain, because a publish rule in `output` is an egress
+  hole wearing an ingress flag. (3) The port list is validated again *inside* the entrypoint before it
+  reaches nft, and nft is fussy about order (`… counter accept comment "x"`, verdict first): get it
+  wrong and the ruleset refuses to install, the sandbox exits 77 with the feature dead, and every
+  `--dry-run` still looks perfect. Only `make e2e` catches that class, so a change here is an e2e
+  change. Measured, and in `docs/networking.md` for a reason: pasta delivers the connection over
+  loopback (the `aisb-publish` counter stays at 0 while the port serves), and a server bound to
+  `127.0.0.1` inside answers nothing on the published port.
 * `build_argv()` — every isolation flag lives here.
 * `build_in()` / `build_progress()` — a build is minutes of apt, a Node tarball and an
   npm install, so it has to announce itself and keep announcing: silence is what a hang