Add --publish: the one ingress control

Everything else in the file gates egress, which left an everyday request unanswered: the
agent starts a dev server inside the sandbox and a human wants to look at it. This puts a
listener on the host that forwards into the container, so a browser, curl or an API
tester reaches the server the sandboxed process runs.

`--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the
cost named in the flag: it is ingress, so whatever that server serves is reachable from
the address it binds. The default address is 127.0.0.1 because a bare podman -p binds
every interface (measured) -- a port committed in a repo config must not quietly be a port
on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback
address warns on every run. The grammar is smaller than podman's on purpose: one port per
entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing
0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused
rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints).

Fail closed, as elsewhere: --net none cannot forward a port and podman discards the
mapping while starting the container anyway, so "it ran" would mean "nothing is
listening"; a host port already in use is named before the container starts, not after a
build; pick_port() will not hand the gate a port this run publishes. The container is
labelled with the ports it was given, and doctor reports them.

Inside, publish_rules() accepts tcp on the published ports in the input chain and never
the output one. Measured (docs/networking.md): pasta delivers the connection over
loopback, so that rule counts 0 packets on the reference host; it is there for a host or a
bridge network that delivers on the interface, and so that `nft list table inet aisb`
answers "what can reach this container". The ports are validated again inside the
entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the
measurement that makes a configured preview look broken: a server bound to 127.0.0.1
inside answers inside and refuses the published port outside, so dev servers must bind
0.0.0.0 -- both skills say so in the change that writes the port.

Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag
precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the
flags reaching the invocation before the image, egress enforcement byte-identical with a
port open, which chain the rule lands in and that a non-numeric port never reaches nft as
code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host
gets its 200 and the same run still refuses a domain outside the allowlist at 403, the
server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host
listener is gone when the container exits.

LLM-Generated: true

tests/unit/03_argv.sh

@@ -197,6 +197,43 @@ pos_cmd="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 '^hello$' | cut -d: -
 if [[ -n "$pos_img" && -n "$pos_lbl" && $pos_lbl -lt $pos_img ]]; then _ok "extra flags precede the image"; else _bad "extra flags precede the image" "img=$pos_img label=$pos_lbl"; fi
 if [[ -n "$pos_cmd" && -n "$pos_img" && $pos_img -lt $pos_cmd ]]; then _ok "the command follows the image"; else _bad "the command follows the image" "img=$pos_img cmd=$pos_cmd"; fi
 
+t_name "published ports reach the invocation, bound to loopback"
+sb --dry-run $A --publish 8000
+assert_contains "--publish 127.0.0.1:8000:8000" "a bare port is bound to loopback on both ends"
+assert_contains "# ingress: publish=[127.0.0.1:8000:8000" "the dry run says what it will let in"
+assert_contains "--label aisb.publish=8000" "the container is labelled with the port it publishes"
+sb --dry-run $A --publish 18080:8000
+assert_contains "--publish 127.0.0.1:18080:8000" "host and container ports are separate"
+sb --dry-run $A --publish 8000 --publish 18080:9000
+assert_count 2 "--publish " "two entries, two flags"
+sb --dry-run $A --publish 0.0.0.0:18080:8000
+assert_contains "--publish 0.0.0.0:18080:8000" "an explicit address is passed through"
+assert_contains "anything that can route to this machine" "and said out loud as an open door"
+sb --dry-run $A --net full --publish 8000
+assert_contains "--publish 127.0.0.1:8000:8000" "--net full can publish too"
+
+# The promise the flag has to keep: it is ingress only. Everything that gates egress must be
+# byte-identical with a port open, or "preview the app" would be a way to turn the policy off.
+t_name "publishing does not touch egress enforcement"
+sb --dry-run $A --publish 8000
+assert_contains "--network pasta:--map-host-loopback,100.64.0.1" "the gate address is still the only door"
+assert_contains "--cap-add=NET_ADMIN" "the entrypoint still gets NET_ADMIN to install the ruleset"
+assert_contains "--cap-drop=ALL" "and still drops everything else"
+assert_contains "HTTP_PROXY=http://100.64.0.1:18081" "the proxy env is still set"
+assert_contains "--security-opt no-new-privileges" "no-new-privileges survives"
+
+# An ipv6 bind keeps its brackets: podman splits the spec on ':' too, and an address full of
+# them has to arrive as one field or the port lands inside the address.
+sb --dry-run $A --publish '[::1]:8000:8000'
+assert_contains '\[::1\]:8000:8000' "the ipv6 bind keeps its brackets in the invocation"
+
+# --publish must precede the image like every other flag, or podman reads it as the command.
+sb --dry-run $A --publish 8000 -- echo hello
+line="$(printf '%s' "$OUT" | tail -1)"
+pos_img="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 'localhost/ai-sandbox' | cut -d: -f1)"
+pos_pub="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 -e '--publish' | cut -d: -f1)"
+if [[ -n "$pos_img" && -n "$pos_pub" && $pos_pub -lt $pos_img ]]; then _ok "--publish precedes the image"; else _bad "--publish precedes the image" "img=$pos_img publish=$pos_pub"; fi
+
 t_name "dry run is side-effect free"
 sb --dry-run $A
 # Ask about the container *this* invocation would have created, not about every sandbox on