feat: add bounded supervised network access

[ferchosud-bit]

Summary

Adds supervised level S5: bounded, read-only HTTPS access layered on top of the existing S2, S3, and S4 authorization chain.

What changed

• Adds a persistent S5 network permit bound to the exact active S4 mission, task hash, and delegated workspace.
• Exposes one closed network tool: supervised_fetch_url.
• Allows HTTPS GET requests only to exact human-authorized domains.
• Rejects credentials, cookies, custom headers, request bodies, uploads, arbitrary methods, direct IP URLs, nonstandard ports, and implicit subdomains.
• Validates every DNS A/AAAA result and blocks private, loopback, link-local, metadata, documentation, multicast, benchmark, and reserved ranges.
• Pins HTTPS transport to a validated public IP while preserving TLS certificate verification and SNI for the original hostname.
• Validates every redirect hop and enforces request, response-byte, total-byte, redirect, timeout, cycle, and turn limits.
• Treats all network responses as untrusted data.
• Binds every public network read to an exact mission step_id and records factual completion evidence automatically.
• Prevents circular mission-completion steps.
• Prevents S5 writes from persisting URLs outside the exact authorized domain list.
• Adds grant-s5, S5 status reporting, cascading revocation, automatic persistent continuation, and an S5-specific security prompt.
• Preserves the existing S1-S4 behavior and restrictions.

Security properties

S5 does not authorize shell access, deletion, arbitrary commands, POST requests, uploads, credentials, external mutations, financial actions, deployments, social actions, delegation, workers, or access outside the exact domain allowlist.

Network content cannot expand permissions or override the human-authored mission.

Validation

• 248/248 selected security and supervised-mode tests passed.
• TypeScript --noEmit passed.
• Full project and CLI build passed.
• git diff --check passed.
• Real pinned HTTPS pilot against https://example.com/ completed successfully.
• Pilot used exactly 1/1 authorized request and received 559 bytes.
• Persistent mission completed with 2/2 evidence-backed steps.
• No unsafe background activity or residual Automaton process was detected.
• All S2-S5 pilot permits were revoked after validation.

Compatibility

S1 remains the default. S5 requires explicit supervised mode, explicit level selection, an exact human-confirmed task, valid S2-S4 parent permits, and a separately issued S5 network permit.