FI-WP-0005 T01-T03: owner declaration, publication decision, egress hosts.

- Owner declaration for the profiled fi-daily-research-brief (proposed):
  inputs, single-commit briefs/** grant, fast-forward-only publication,
  quality rules, model requirements without env selection, completion
  evidence and rollback pins.
- Decision: origin publication is a typed grant on the run, not an
  executor default.
- docs/sources-egress.yaml: 17 exact host:443 entries for the sandbox,
  tested for sand-boxer format and drift against the prose allowlist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 51320@bnt-lap001
Assistant-Session: 9d40b4c7-8e3c-42ee-b755-d658d4640d6c

docs/sources-allowlist.md

@@ -3,6 +3,11 @@
 Standing channels for Freedom Intelligence briefs (axes A–D). Prefer **primary**
 sources over aggregators. This is a watchlist, not a scrape mandate.
 
+Automated runs reach the network only through the hosts in
+[`sources-egress.yaml`](sources-egress.yaml) (FI-WP-0005-T03). Adding a
+channel here that needs a new host means adding that host there too;
+`scripts/test_sources_egress.py` checks the two stay in step.
+
 ---
 
 ## Axis A — Frontier & commercial