feat(supervisor-network): add request inspection seam poc

[afourniernv]

Summary

Add an additive request-inspection seam to openshell-supervisor-network so the sandbox runtime can call an external inspector at the outbound HTTP boundary. This is a narrow POC for loose coupling with semantic middleware systems like NeMo Relay, without implementing the full middleware subsystem proposed in RFC #1738.

Related Issue

• Related to rfc-0009: sandbox egress middleware #1738
• Related to docs(rfc): add loose inspection contract proposal #1930
• Related to [Enhancement]: add an optional neutral inspection adapter surface for OpenShell interoperability NeMo-Relay#277

Changes

• Add a minimal inspection contract and optional inspector client in openshell-supervisor-network
• Thread the optional inspector through the real outbound HTTP forwarding path
• Support allow, deny, and header mutation decisions at the runtime boundary
• Add focused tests covering the demo inspector client roundtrip and request-inspection seam

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.