feat(egress): add controlled_egress SDK helper emitting agent-signed egress_receipt/1

[oleg-bk]

Summary

Adds AVPAgent.controlled_egress(...), the first SDK boundary that emits an agent-signed egress_receipt/1. The helper performs the HTTPS request itself (no caller-supplied send callback); receipts record what the helper actually did, not what the caller declared it would do.

What the helper does

• Computes payload_digest_hex = sha256(body).hexdigest() and runtime_payload_hash = f"sha256:{payload_digest_hex}".
• Calls /v1/runtime/evaluate with action="network.egress", payload_hash=runtime_payload_hash, and the caller's delegation receipt.
• On ALLOW → opens the HTTPS connection via embedded httpx.Client and signs an egress_receipt/1 with outcome=SENT (or FAILED on connection-class error, with sanitized error class only).
• On BLOCK → does NOT open the connection; signs receipt with outcome=BLOCKED.
• On WAITING_FOR_HUMAN_APPROVAL → does NOT open the connection; returns status="approval_required" with no receipt in v0.1.

Receipts are agent-signed, not backend-signed. The signer DID equals the agent's identity DID. Customers verify via verify_egress_receipt(receipt_jcs, trusted_signer_dids=[agent.did]).

Agent-DID binding

Both the signer and the verifier enforce body.agent_did == proof signer DID. Without this an agent-signed receipt could claim another identity performed the egress, breaking offline audit attribution.

Dependency

Depends on AVP backend PR: https://github.com/agentveil-protocol/avp/pull/1

That PR adds network.egress to the Runtime Gate catalog. Until it is deployed, controlled_egress(...) will safely degrade to approval_required for unknown-action WAITING responses.

What this does NOT claim

• AVP catches all egress — false. Only controlled_egress(...) calls are recorded.
• AVP is a firewall — false. No network interception lands.
• The production AVP backend signed these receipts — false. Receipts are signed by the agent's own identity in v0.1.
• AVP replaces sandboxing — false.
• AVP intercepts arbitrary requests.post(...) — false. Customers must use the helper for the receipt to be produced.

Files changed

• agentveil/egress.py
• agentveil/agent.py
• agentveil/__init__.py
• tests/test_egress_sdk_wrapper.py

Tests run

• python3 -m pytest tests/test_egress_sdk_wrapper.py -q → 10 passed
• python3 -m pytest tests/test_controlled_action.py tests/test_contract.py tests/test_auth.py tests/test_delegation_issuance.py tests/test_identity.py -q → 65 passed
• git diff origin/main..HEAD --check → clean

Remaining non-blocking gaps

• No backend-signed EgressReceipts (future /v1/egress/sign).
• No egress_receipt/2 schema with decision_receipt_hash cross-reference.
• No sandbox sidecar.
• No CLI surface for non-Python agents.

Implemented by Claude and reviewed with assistance from Codex.