[SDK] Node SDK rejects network.proxy on LXC, which the backend has supported since #798 #1074

Relevant area(s)

Linux

Brief description of your issue

The Node SDK rejects network.proxy on Linux for containment: 'lxc', but LXC has supported it since #798 (iptables deny-all-except-proxy + HTTP_PROXY injection + /etc/hosts pin). The SDK gate predates that work and was never revisited, so LXC callers can't use a proxy from the SDK at all.

Gate: sdk/node/src/sandbox.ts:350-358 allows only bubblewrap and process.
Native: src/core/wxc_common/src/config_parser.rs:962-972 accepts lxc.

Two things need deciding together, since lifting the gate alone isn't enough:

1. LXC additionally requires network.enforcementMode: 'firewall' or 'both' with a proxy (config_parser.rs:1123-1137) — native rejects capabilities rather than auto-promoting.
2. SandboxPolicy.network (sdk/node/src/types.ts:428-445) exposes no enforcementMode, so there is no way for a caller to supply it. Either the SDK promotes an unset mode to firewall for LXC, or SandboxPolicy gains the field.

The JSDoc on SandboxPolicy.network.proxy (types.ts:437) also lists only "Windows ProcessContainer, Linux Bubblewrap, and macOS Seatbelt" and needs updating either way.

Steps to reproduce

1. On Linux, call createConfigFromPolicy({ version: '0.6.0-alpha', network: { proxy: { url: 'http://proxy.example:8080' } } }, 'lxc').
2. Observe the throw.

Expected behavior

The config is produced (with whatever enforcementMode the chosen fix implies), and the same policy runs on LXC with the proxy enforced.

Actual behavior

Throws Proxy configuration is not supported on Linux containment='lxc'. Use containment 'bubblewrap' (or the abstract 'process') for proxy-based host filtering. - even though the executor would have accepted it.