[codex] Document runtime network behavior

[Joncallim]

Summary

Addresses #14 without closing it automatically.

This PR documents DockerMap's current external-network behavior before alpha release:

• separates build/maintenance egress (npm ci, Cargo dependency fetches, npm audit) from DockerMap runtime behavior
• documents that runtime package registry/advisory, DNS-provider API, Cloudflare API, and generic external-API lookups are disabled or not implemented today
• calls out fixed delegated Tailscale/Headscale CLI behavior, including the daemon environment/config caveat
• calls out browser egress from Google-hosted fonts
• clarifies that package-update/advisory shapes in contracts are not currently populated by a runtime registry/advisory lookup
• adds source-grep verification guidance and release-checklist evidence notes

Validation

• git diff --check
• rg -n "advisory|registry|external|network|Tailscale|Headscale|token|auth" docs crates apps packages
• rg -n "fetch\\(|Command::new|npm audit|npm view|registry|advisory|fonts.googleapis|fonts.gstatic" apps crates packages docs -g '!**/package-lock.json' -g '!**/Cargo.lock'
• npm run test:api (10/10 passed)
• npm run test:rust:daemon (15/15 passed)

Review Gates

• QA: PASS
• Security: PASS
• Adversarial: PASS

Notes

No real tokens, hostnames, auth headers, registry credentials, or private provider output are included.