fix(pipelock): allow agent->sidecar traffic via SSRF exception

The agent's HTTP_PROXY points at pipelock, so a request to
http://cred-proxy:9099/... arrives at pipelock; pipelock resolves
the host, sees an RFC1918 address (the bottle's internal Docker
network sits in 172.x), and 403's "SSRF blocked: cred-proxy
resolves to internal IP 172.20.0.4". Bypassing pipelock entirely
would also remove its body scanner from the agent->cred-proxy leg
— we want to keep that DLP coverage.

Pipelock has `ssrf.ip_allowlist` for exactly this: CIDRs that
override the built-in internal-IP block while api_allowlist + body
scanning + tls_interception keep firing.

Wiring:

- `pipelock_build_config` accepts `ssrf_ip_allowlist`; when
  non-empty, emits an `ssrf: { ip_allowlist: [...] }` block.
- `pipelock_render_yaml` renders that block.
- `PipelockProxyPlan` gains `internal_network_cidr`.
- New `network_inspect_cidr(name)` helper reads the Docker-assigned
  subnet via `docker network inspect`.
- launch.py: after `network_create_internal`, inspect the CIDR,
  re-render the yaml with `ssrf_ip_allowlist=(cidr,)`, overwrite
  the file in place; `DockerPipelockProxy.start` then docker-cp's
  the updated content. Prepare's initial render stays unchanged
  (CIDR isn't known yet at prepare time).

The exception scope is the bottle's own internal network only —
agent ↔ pipelock / git-gate / cred-proxy. Body scanning still
applies to the bytes flowing through pipelock; pipelock just no
longer treats those internal IPs as exfil targets.

tests/unit/test_pipelock_yaml.py

@@ -77,6 +77,21 @@ class TestBuildConfig(unittest.TestCase):
                 ca_cert_path="/etc/pipelock-ca.pem",
             )
 
+    def test_ssrf_block_omitted_when_no_allowlist(self):
+        cfg = pipelock_build_config(fixture_minimal().bottles["dev"])
+        self.assertNotIn("ssrf", cfg)
+
+    def test_ssrf_block_emitted_when_allowlist_supplied(self):
+        # The bottle's internal Docker subnet lands here at launch
+        # time so cred-proxy:9099 (172.x.x.x) doesn't trip pipelock's
+        # RFC1918 SSRF guard.
+        cfg = pipelock_build_config(
+            fixture_minimal().bottles["dev"],
+            ssrf_ip_allowlist=("172.20.0.0/16",),
+        )
+        self.assertIn("ssrf", cfg)
+        self.assertEqual({"ip_allowlist": ["172.20.0.0/16"]}, cfg["ssrf"])
+
 
 class TestRenderAndWrite(unittest.TestCase):
     def setUp(self):
@@ -148,6 +163,18 @@ class TestRenderAndWrite(unittest.TestCase):
         self.assertIn("passthrough_domains:", content)
         self.assertIn('- "api.anthropic.com"', content)
 
+    def test_render_emits_ssrf_block_when_allowlist_given(self):
+        cfg = pipelock_build_config(
+            fixture_minimal().bottles["dev"],
+            ca_cert_path="/etc/pipelock-ca.pem",
+            ca_key_path="/etc/pipelock-ca-key.pem",
+            ssrf_ip_allowlist=("172.20.0.0/16",),
+        )
+        text = pipelock_render_yaml(cfg)
+        self.assertIn("ssrf:", text)
+        self.assertIn("ip_allowlist:", text)
+        self.assertIn('- "172.20.0.0/16"', text)
+
 
 if __name__ == "__main__":
     unittest.main()