fix(policy): allowlist wttr.in in weather egress preset

docs/network-policy/integration-policy-examples.mdx

@@ -251,7 +251,7 @@ The Brave Search API key is still configured separately during onboarding or thr
 
 Use the `weather` preset when the agent needs read-only weather or geocoding lookups.
 The Balanced and Open tiers include it by default.
-The preset covers Open-Meteo, geocoding, and National Weather Service endpoints without enabling messaging or productivity APIs.
+The preset covers read-only public weather and geocoding lookups — current conditions, forecasts, geocoding, and weather alerts — without enabling messaging or productivity APIs.
 
 ```bash
 $$nemoclaw my-assistant policy-add weather --dry-run

nemoclaw-blueprint/policies/presets/weather.yaml

@@ -9,6 +9,28 @@ network_policies:
   weather:
     name: weather
     endpoints:
+      # Hosts the bundled OpenClaw weather skill actually calls (web_fetch + curl).
+      # wttr.in is primary; wttr.is is the documented fallback host (OpenClaw >= 2026.6.2).
+      # Paths are /<location> (city, region, airport code, or coordinates) and /:help.
+      #
+      # Why path "/**": wttr.in's location namespace IS the path — /<city>, /<airport>,
+      # /<lat,lon>, /~<place>, /:help — so there is no narrower stable prefix to pin to.
+      # Scope stays bounded: GET/HEAD only (every other method is denied by deny-by-default),
+      # a single read-only public host family, and no credentials are sent.
+      - host: wttr.in
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: HEAD, path: "/**" }
+      - host: wttr.is
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: HEAD, path: "/**" }
       - host: api.open-meteo.com
         port: 443
         protocol: rest