feat: return combined bwrap runtime candidate to Glas

Answer the GLAS-WP-0015 handoff for SAND-WP-0015-T04 without activating any
production path.

Add candidate profile profile.claude-agent-dev-proof v1.1.0 (ext.bwrap,
localhost-only, default: deny, declared api.anthropic.com:443) for GLAS-WP-0012
review. The committed profile grants no egress by itself — ext.bwrap refuses it
unless owner extension config independently allowlists the destination — and a
regression test asserts that fail-closed default.

Reconcile the differing project examples in favour of the acceptance runner's
actor agt / project glas-local-proof, keeping the documented credential route
bound to that single project rather than broadening it.

Record the return contract (profile revision, host scope, consumer tuple,
runtime digest and mount paths, declared egress, value-free denial/cleanup
receipts) in docs/bwrap-runtime.md.

T04 stays wait: Claude credential lane, owner machine authentication, pinned
Claude executable and real-model acceptance remain operator gated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HjyScPKb8MV8y2VZHGFSSV

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 716401@bnt-lap001
Assistant-Session: 0d02392b-d4a8-4fed-98e3-32333f768169

tests/test_egress.py

@@ -117,3 +117,21 @@ def test_failed_broker_readiness_removes_egress():
         with pytest.raises(RuntimeError, match="startup failed"):
             ext.wait_ready(handle)
         cleanup.assert_called_once_with(handle)
+
+
+def test_candidate_claude_profile_declares_exact_destination_and_fails_closed(tmp_path):
+    """The committed candidate profile grants nothing without owner allowlisting."""
+    from sandboxer.extensions.bwrap import BwrapExtension
+    from sandboxer.profiles.loader import load_profile
+
+    profile = load_profile("profile.claude-agent-dev-proof")
+    assert profile.version == "1.1.0"
+    assert profile.extension == "ext.bwrap"
+    assert profile.network.default == "deny"
+    assert profile.network.egress == ["api.anthropic.com:443"]
+    assert profile.setup.secret_refs == []
+
+    ext = BwrapExtension({"base_dir": str(tmp_path / "unused")})
+    with pytest.raises(ValueError, match="owner allowlist"):
+        ext.provision(profile, {}, "localhost")
+    assert not (tmp_path / "unused").exists()