fix: cherry-pick commit 8cf2cea to claude/create-sidecar-container-envoy

[Claude]

Cherry-picked commit 8cf2cea06a4da1c84fd11b5ac4205e66c97b3634 containing PR review fixes to the claude/create-sidecar-container-envoy branch.

Changes Applied

• API proxy firewall exemption: Added proxyIp parameter to setupHostIptables() to allow unrestricted egress for the sidecar at 172.30.0.30
• Envoy healthcheck: Changed from custom health endpoint (http://localhost:10000/) to Envoy admin endpoint (http://localhost:9901/ready)
• Security hardening: Simplified cap_drop from selective capability list to ['ALL'] for maximum security
• Test coverage: Added 19 unit tests covering API proxy service generation, environment injection, security hardening, and conditional behavior
• Documentation: Updated comments and docs for host header rewriting and conditional BASE_URL environment variables

The cherry-pick resolved cleanly without conflicts, as the branch already contained the API proxy sidecar implementation being refined by these changes.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS ✅

All Bun projects installed successfully and all tests passed.

AI generated by Build Test Bun

[github-actions]

Go Build Test Results

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS ✅

All Go projects built and tested successfully.

AI generated by Build Test Go

[github-actions]

Build Test: Deno - PASSED ✅

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: PASS ✅

All Deno tests completed successfully.

AI generated by Build Test Deno

[github-actions]

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

All .NET projects successfully restored, built, and ran with expected output.

AI generated by Build Test .NET

[github-actions]

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	PASS	✅ PASS
execa	✅	PASS	✅ PASS
p-limit	✅	PASS	✅ PASS

Overall: ✅ PASS

All Node.js projects built and tested successfully.

AI generated by Build Test Node.js

[github-actions]

Smoke Test Results - PASS ✅

Last 2 Merged PRs:

• fix: hide workDir from agent container to prevent secrets exposure #718: fix: hide workDir from agent container to prevent secrets exposure
• fix(chroot): detect cargo binaries when CARGO_HOME unset #750: fix(chroot): detect cargo binaries when CARGO_HOME unset

Test Results:

• ✅ GitHub MCP
• ✅ Playwright (github.com title verified)
• ✅ File Writing
• ✅ Bash Tool

cc: @Copilot @lpcox

AI generated by Smoke Copilot

[github-actions]

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

All Java projects compiled successfully and all tests passed.

AI generated by Build Test Java

[github-actions]

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

• fix: hide workDir from agent container to prevent secrets exposure
• feat: hide /tmp/gh-aw/mcp-logs/ from agent containers

Test Results:
✅ GitHub MCP - Retrieved PRs successfully
✅ Playwright - Navigated to GitHub, verified title contains "GitHub"
✅ File Write - Created test file at /tmp/gh-aw/agent/smoke-test-claude-21959823980.txt
✅ Bash Tool - Verified file contents successfully

Overall Status: PASS

AI generated by Smoke Claude

[Mossaka]

Closing PR in favor of tracking issue #839.