Deliver env to every exe session, and document the sbx policy rule

[czpython]

Summary

• exe. --env lands in /etc/profile.d/exe-env.sh. Only a login shell reads it. A plain SSH command session, which is how an agent runs, saw no variables. exe's own sshd has no PAM, so /etc/environment does nothing there. A plain session does read ~/.bashrc. The adapter now always sends a setup script when env is given. The script puts the exports at the top of ~/.bashrc with a heredoc, then runs the body. --env stays for login shells and the exe UI. The writer is environment.bashrc, beside persist.
• Network. The exchange is the first flow from a sandbox to drukbox. The network needs one rule for it: one address, one port, every sandbox. The deploy doc gives it as a tailnet grant, and as the sbx policy allow network line next to the daemon start. No provider code.

Verification

• uv run ruff check, uv run ruff format --check, uv run pyright
• uv run pytest: 555 passed. The exe tests compare the setup script line by line.
• Three beds, from inside the box: the placeholder and exchange URL in a plain session, a model call through the exchange answering 200 with one fetch at a dummy issuer that serves the live subscription token, 401 for the placeholder at Anthropic, 403 for a wrong placeholder, an exchange restart that costs one fetch, and a clean delete.

provider	bed	result
docker	production host	11 of 11
docker-sbx	KVM host, one global sbx policy rule	11 of 11
exe	production host, one tailnet grant on tcp:8880	11 of 11

[czpython]

Acceptance rerun on this branch, image built from c31f6a4 on each bed.

provider	bed	result
docker	production host	11 of 11
docker-sbx	KVM host, one global sbx policy allow network 172.17.0.1:8880	11 of 11, no manual step per sandbox
exe	production host, box on the tailnet	env now reaches a plain session; the box cannot reach the exchange

Each passing run, from inside the box: the placeholder and the exchange URL in the session, a model call through the exchange answering 200 with one fetch at the issuer, the placeholder refused straight at Anthropic with 401, a wrong placeholder refused with 403, an exchange restart costing one fetch and no failure, and a clean delete.

On exe the fix in this branch does what it should. A plain SSH session now shows ANTHROPIC_AUTH_TOKEN=drk.… and ANTHROPIC_BASE_URL=http://100.92.230.15:8880/api.anthropic.com. What remains is network, not drukbox: the box joins the tailnet and tailscale ping reaches the production node, but TCP to it times out on every port tried, 22, 443, 8443 and 8880. The tailnet policy does not let tag:sandbox reach that node. That is a deployment decision, either a tailnet rule for the exchange port or a public HTTPS name for the exchange.

[czpython]

exe passes too, 11 of 11, after one tailnet grant: tag:sandbox to a hosts alias for the exchange node on tcp:8880. The sandbox reaches that port and nothing else on the node. The deploy doc now states the rule next to the sbx policy line.

All three providers pass the same sequence from inside the box on this branch.