Design notes for making package registry traffic on Linux unable to
avoid the PMG proxy, scoped to CI runners and Linux servers.
Covers the cgroup connect hook and why the socket layer was chosen,
why redirect is preferred over deny, the proxy self traffic exemption
and cgroup escape analysis, when the destination name becomes knowable
and why SNI is the authoritative source, and findings from the network
visibility POC.
linux-network-enforcement.md is a cleaner rewrite of the same material.
Both are kept for now.
