Add --publish: the one ingress control

Everything else in the file gates egress, which left an everyday request unanswered: the
agent starts a dev server inside the sandbox and a human wants to look at it. This puts a
listener on the host that forwards into the container, so a browser, curl or an API
tester reaches the server the sandboxed process runs.

`--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the
cost named in the flag: it is ingress, so whatever that server serves is reachable from
the address it binds. The default address is 127.0.0.1 because a bare podman -p binds
every interface (measured) -- a port committed in a repo config must not quietly be a port
on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback
address warns on every run. The grammar is smaller than podman's on purpose: one port per
entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing
0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused
rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints).

Fail closed, as elsewhere: --net none cannot forward a port and podman discards the
mapping while starting the container anyway, so "it ran" would mean "nothing is
listening"; a host port already in use is named before the container starts, not after a
build; pick_port() will not hand the gate a port this run publishes. The container is
labelled with the ports it was given, and doctor reports them.

Inside, publish_rules() accepts tcp on the published ports in the input chain and never
the output one. Measured (docs/networking.md): pasta delivers the connection over
loopback, so that rule counts 0 packets on the reference host; it is there for a host or a
bridge network that delivers on the interface, and so that `nft list table inet aisb`
answers "what can reach this container". The ports are validated again inside the
entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the
measurement that makes a configured preview look broken: a server bound to 127.0.0.1
inside answers inside and refuses the published port outside, so dev servers must bind
0.0.0.0 -- both skills say so in the change that writes the port.

Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag
precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the
flags reaching the invocation before the image, egress enforcement byte-identical with a
port open, which chain the rule lands in and that a non-numeric port never reaches nft as
code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host
gets its 200 and the same run still refuses a domain outside the allowlist at 403, the
server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host
listener is gone when the container exits.

LLM-Generated: true

PLAN.md

@@ -256,6 +256,52 @@ destination too. It is refused now, with the reason, instead of podman's. (`--mo
 type=bind,src=…,dst=…` parses it happily; switching the mount form for one character is not
 worth the relabel-option churn that comes with it.)
 
+### 14 — Publishing a port: the one control that runs the other way
+
+Everything up to here gates egress, which left an everyday request unanswered: the agent starts a
+dev server *inside* the sandbox and a human wants to look at it. The documented answer used to be
+"run the server on the host", which is good advice until the agent has to drive the server — seed the
+database it starts, migrate then serve, hit its own endpoints, read its logs. So: `--publish` /
+`publish`, ingress, with the cost named in the flag rather than discovered later.
+
+Two measurements decided the shape. A bare podman `-p 8000:8000` binds **every interface** on the
+host, so a port committed in a repo config would also be a port opened on the LAN — hence the default
+bind address is `127.0.0.1`, an address in the spec is written as `addr:host:container` and warns,
+and `publish_addr` exists as a machine-wide override nobody should put in a project file. And the
+`input` chain, which reads as `policy drop` with no room for a forward, turns out not to block it:
+`nft -a list chain inet aisb input` while a published port serves traffic shows the
+`aisb-publish` rule at **0 packets**, because pasta forwards into the namespace over loopback and
+`iifname "lo" accept` carries it. The explicit rule is therefore not what makes publishing work here;
+it is what makes it work on a host that delivers on the interface, and what makes
+`nft list table inet aisb` answer "what can reach this container" instead of leaving that question to
+a flag on the host.
+
+A third measurement became the documentation, because it is what makes a configured preview look
+broken: a server bound to `127.0.0.1` *inside* answers 200 from inside and refuses the published port
+from the host. pasta delivers to the container's own address, so the project's dev command has to bind
+`0.0.0.0` — `--host 0.0.0.0`, `runserver 0.0.0.0:8000` — and the skill is told to say so in the same
+change that writes the port.
+
+The grammar is deliberately smaller than podman's: `port`, `host:container`, `addr:host:container`,
+one port per entry, no ranges and no `/udp`, because this list is reviewed line by line and a range is
+a line nobody reads. An address requires all three parts, so `127.0.0.1:8000` is refused with the
+grammar in the message instead of silently meaning whichever of the two things podman would have
+picked. No `-p` alias: `-p` belongs to the harness (`claude -p` prints), and an unknown flag already
+passes through. Refusals follow the usual rule — `--net none` cannot forward a port and podman
+discards the mapping while starting the container anyway, so "it ran" would mean "nothing is
+listening"; and a host port already in use is named before the container starts, not after a build.
+`pick_port()` skips ports this run publishes, or the gate would bind the port the sandbox asked for
+first and lose the run.
+
+The unit tests check the shape (`--publish 127.0.0.1:8000:8000`, the `# ingress:` header, which chain
+the rule lands in, a non-numeric port never reaching nft as code) and the e2e file checks the only
+question that matters: a real container with `enforce=nft`, a host `curl` that gets 200, **the same
+run still refusing a non-allowlisted domain at 403**, the server running as uid 1000 with no
+capabilities so it cannot widen its own port, and the host listener gone once the container exits.
+That test paid for itself immediately: the first version of the rule put `comment` before `accept`,
+nft refused it, and the sandbox exited 77 — correctly refusing to run unenforced, and silently
+killing the feature, with `--dry-run` looking perfect.
+
 ## Follow-ups (not yet done)
 
 * **`--net unix` mode**: `--network=none` plus a unix-socket proxy and an in-container
@@ -285,5 +331,14 @@ worth the relabel-option churn that comes with it.)
 * **Bridging extensions/skills on request**: `--pi-mount-ext` or similar for the
   extension paths named in `enabledExtensionPaths`, which are host paths and therefore
   currently dropped; needs the same explicit-grant shape as `--mount`.
+* **Published ports in the driver**: `.ai-sandbox/config` already reaches every child unit, so a
+  pipeline can publish — but two units running in sequence want the same port, and a long run holding
+  one is a decision the driver should make out loud (`--publish` per unit, or a range handed out from
+  a pool) rather than inherit.
+* **`publish = :8000`** (podman's "pick a free host port"): useful for parallel sandboxes, and it
+  needs the chosen port reported back to the terminal, since nothing in the config says what to open
+  in the browser.
+* **UDP publishing**: deliberately left out of v1. It drags in the protocol suffix the parser
+  refuses, and the sandboxed use cases (dev servers, APIs, hot-reload) are all TCP.
 * **`models.json` review surface**: `inspect` could print the exact diff between host
   config and bridged config, so a change is reviewable before a run rather than after.