feat: hardened proxy-honoring runtime image for the Isolated tier

[imneov]

What

ADR-0003 requires the Isolated tier's runtime image to honor HTTP_PROXY/HTTPS_PROXY without bypass paths and to fail closed when the proxy is unreachable (no direct-connect fallback, no proxy-ignoring socket libraries; every bundled tool/SDK audited for proxy-honoring behavior).

The v1 series (#8 / PR #21) enforces egress at the env-injection layer and — per the PR #21 adjudication — restricts isolated instances to the platform default image. But the platform default (openclaw-lite / hermes-lite) is not yet hardened to the ADR-0003 standard. Until this image exists, the tier's egress guarantee rests on env-level enforcement only.

Acceptance criteria

• An isolated-tier image variant that honors proxy env for all bundled tools/SDKs (audit list documented)
• Fail-closed behavior verified: with the proxy unreachable, outbound HTTP(S) fails rather than falling back to direct connection
• Image wired as the isolated-mode platform default; version pinned
• Verification evidence (in-cluster test with proxy up vs down)

Blocked by

None — parallel to the ClawManager backend track; #8 ships env-level enforcement first.

Refs

ADR-0003, spec #11 (Egress enforcement), PR #21 review adjudication.

[imneov]

Feasibility recon (read-only, 2026-07-17)

Where the images are built: NOT in this repo. The root Dockerfile builds the ClawManager app image (server + frontend on nginx). The lite runtime images come from ghcr.io/yuan-lab-llm/agentsruntime/openclaw-lite:latest and .../hermes-lite:latest (defaults in backend/internal/config/config.go:285-286, migration 034, deployments/k8s/clawmanager-apply.sh:14-15). The only runtime-adjacent Dockerfile here is deployments/hermes-runtime/Dockerfile.tui-dist — a TUI asset build on an external Hermes base, not the lite image chain. Conclusion: the hardening work lands in the external agentsruntime image pipeline (or wherever those GHCR tags are produced).

Known outbound-capable contents (repo evidence): OpenClaw CLI (gateway run), Hermes Python venv runtime, node/npm in the Hermes derivative. Full tool inventory (curl/git/SDKs) unconfirmed — needs docker pull + audit of the actual images.

Relevant platform fact: the "egress proxy" endpoint today is the ClawManager app itself (service port 3128 → app port 9001, plain HTTP + HTTPS CONNECT in egress_proxy_handler.go) — consistent with spec #11's named v1.x follow-on to harden the trust-all proxy.

Recommended path:

1. Confirm ownership/access to the agentsruntime image build repo (blocking question).
2. First increment there: fail-closed entrypoint wrapper (verify proxy reachability before exec; export proxy env process-wide) + drop/limit proxy-ignoring tools.
3. Then the ADR-0003 tool-by-tool proxy-honoring audit, with an in-cluster proxy-up/proxy-down verification harness.

Blocked on: access to the image build pipeline — needs an owner decision.