Support wildcard subdomain keys for host-mapped TCP egress

[ShravanSunder]

Problem

tcp.hosts currently requires exact guest host keys. That is nicely explicit for local development targets, but it is awkward for services whose raw TCP/WebSocket endpoints are intentionally sharded across dynamic subdomains.

One concrete example is Discord Gateway traffic. A client may connect to gateway.discord.gg:443 or regional gateway hosts such as gateway-us-east1-b.discord.gg:443. Callers that use Gondolin host-mapped TCP as a narrow WebSocket bypass have to enumerate every possible gateway host, and missed regional hosts can produce intermittent failures.

Proposed shape

Allow wildcard subdomain patterns in tcp.hosts keys only, while keeping mapped TCP a narrow exception path.

Proposed semantics:

• allow leading-label subdomain wildcard keys like *.discord.gg:443
• keep mapping values exact UPSTREAM_HOST:UPSTREAM_PORT
• reject wildcard values
• reject global * TCP mappings
• reject mid-label wildcard forms such as api.*.example.com unless there is a maintainer preference for broader HTTP-allowlist parity
• do not make *.example.com match the apex example.com; callers should list the apex separately
• keep exact mappings higher priority than wildcard mappings
• for overlapping wildcard suffixes, prefer the longest matching suffix

This would let callers write a least-permissive rule such as *.discord.gg:443 for dynamic gateway shards without opening unrelated domains like discord.com or all outbound TCP.

Security notes

Mapped TCP is already documented as a reduced-security exception path because it bypasses HTTP hooks and HTTP secret placeholder substitution. This proposal does not change that model. The intent is to make one narrowly scoped exception easier to express, not to create generic NAT or broad egress.

Expected implementation areas

Likely touched files:

• host/src/qemu/tcp.ts
• host/test/qemu-net.test.ts
• docs/sdk-network.md
• docs/cli.md
• docs/network.md
• docs/security.md

I plan to open a small PR with minimal tests covering wildcard match, apex non-match, exact-over-wildcard precedence, longest-suffix wildcard precedence, and wildcard target rejection.