eval: keep the subject namespace to least privilege (CA private key, ICMP)

Context

PR #2947 introduced the per-cell MITM proxy and the nftables namespace policy. Two parts of that setup grant the subject more than the isolation contract requires. Neither is a network escape, and neither triggers under the current experiment specs — but both widen what a subject can reach or observe beyond what the design intends.

1. The MITM CA private key is readable by the subject

egress-proxy/entrypoint.sh:12 points mitmproxy's confdir at /opt/maka-egress, so mitmproxy generates mitmproxy-ca.pem — which contains the private key — into that directory. docker-compose-egress-proxy.yaml:13 then mounts the whole maka-eval-egress-state volume into main read-only so the subject can trust the CA cert. The subject therefore also reads the private key and hits.jsonl (which reveals which of its own requests were blocked).

The CA is per-cell and short-lived, so the practical impact is close to zero — the subject can only MITM itself. It is still more exposure than the mount needs.

Fix: copy only mitmproxy-ca-cert.pem into a separate cert-only volume and mount that into main.

Verification: docker compose exec main ls /opt/maka-egress should show the cert and nothing else.

2. The namespace policy accepts ICMP unconditionally

egress-proxy/network-policy:47-48 accept all outbound ICMP and ICMPv6, while :49 rejects every non-TCP protocol. The README states that all subject traffic is forced through the audited proxy. Exfiltration over ICMP requires a cooperating external endpoint and is outside the stated "accidental contamination" threat model, so this is a contract mismatch rather than a live risk.

Fix: drop the unconditional accepts, or narrow them to a stated destination and protocol if Harbor needs them for health checks — and document the exception.

Verification: inside a real cell namespace, explicit-proxy HTTPS succeeds while direct-IP TCP, external UDP, and external ICMP all fail; loopback provider proxy and Docker DNS still work.