docs(security): add network egress isolation guide for Docker deployments

[Manzela]

Summary

Adds a guide for isolating network egress in Docker deployments of Hermes.

The default docker-compose.yml uses network_mode: host, which gives the agent container unrestricted outbound access. This is fine for development, but in production (especially with gateway-attached or unattended setups) it leaves the door open for prompt injection attacks that exfiltrate data via arbitrary HTTP requests from tool-generated shell commands.

The guide shows two approaches:

1. Basic: Replace network_mode: host with two Docker bridge networks (internal + egress), keeping the agent on the internal-only network.
2. With proxy: Route outbound traffic through a Squid proxy with an explicit domain allowlist (OpenAI, Anthropic, OpenRouter, Telegram, etc.).

Includes validation commands to confirm isolation is working, and documents known limitations (DNS resolution, sandbox backend interaction).

Changes

• docs/security/network-egress-isolation.md: New file (195 lines)

Backward Compatibility

Documentation only. No code changes, no dependency changes. The existing docker-compose.yml is unchanged.

Validation

• All compose snippets validated with docker compose config
• Architecture diagram and allowlist tested against a local Squid instance
• Verification commands confirmed working on Docker 27.x / Compose v2.35

Related

Complements SECURITY.md §2 trust model documentation.