[BUG] sandbox.network.allowedDomains does not block egress — non-allowlisted hosts return 200 with real content (macOS)

What happened

With sandbox.network.allowedDomains configured, outbound requests to hosts
not in the allowlist are not blocked — they complete successfully and
return real content. The allowlist appears to be loaded but not enforced as a
deny-by-default policy.

Per the docs, the sandbox network layer should have the localhost proxy return
CONNECT 403 for denied domains. In practice it returns CONNECT 200 and
tunnels to the real host.

Environment

• claude --version: 2.1.212
• OS: macOS (darwin 25.5.0)
• Install: npm-global (@anthropic-ai/claude-code@2.1.212)

Config (minimal repro)

{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["github.com", "*.github.com"]
    }
  }
}

Steps to reproduce

Run each under the sandbox:

# In allowlist — expected 200
curl -sS -o /dev/null -w '%{http_code}\n' https://github.com
# → 200  (as expected)

# NOT in allowlist — should be blocked, but returns 200
curl -k -sS -o /dev/null -w '%{http_code}\n' https://example.com
# → 200  (expected block / CONNECT 403)

curl -k -sS -o /dev/null -w '%{http_code}\n' https://httpbin.org/status/200
# → 200  (expected block)

# Non-existent host — fails at the proxy due to DNS, NOT due to the allowlist
curl -sS https://nonexistent-host-xyz.invalid
# → curl: (56) CONNECT tunnel failed, response 502

Proof the 200 is a real response and not a proxy stub — example.com
(not in the allowlist) returns the genuine page:

curl -k -sS https://example.com -D - -o /dev/null
# HTTP/1.1 200 Connection Established   <-- proxy opens the CONNECT tunnel
# HTTP/2 200
# content-type: text/html
# (body: <title>Example Domain</title>, 559 bytes)

Expected

Hosts not in allowedDomains should be blocked (proxy CONNECT 403 and/or the
Seatbelt backstop), so the two non-allowlisted requests above should fail.

Actual

Only unresolvable hosts fail (proxy 502 at DNS time). Any resolvable host —
allowlisted or not — is tunneled and returns 200 with real content. The
allowedDomains allowlist has no blocking effect on egress.

Note

Without -k, curl fails earlier with exit 77
(error setting certificate verify locations: CAfile: /etc/ssl/cert.pem),
a separate sandbox CA artifact that occurs for allowed hosts too; -k isolates
the network-reachability question.

This is the inverse of #37970, #56959, #37782 (those report allowlisted
domains being wrongly blocked / ignored in Cowork, Bedrock, and Node.js DNS
paths respectively). This report is the opposite failure: non-allowlisted
egress is not blocked in standard local mode on macOS.