Vouch request: kosaku-sim

[kosaku-sim]

What do you want to work on?

I want to fix #642 and #504 which cause DNS resolution failures (EAI_AGAIN) inside sandbox. WebSocket libraries like @slack/socket-mode bypass HTTP_PROXY and need direct UDP 53 + TCP 443 access. My PR #675 adds targeted iptables ACCEPT rules for DNS and configurable direct TCP endpoints.
I'm currently running a patched build in production and would like to move to an official release.

Why this change?

• I run NemoClaw (OpenClaw on AWS) in my organaization.
• Slack Socket Mode fails inside the sandbox because the ws library bypasses HTTP_PROXY and attempts direct DNS resolution, which is blocked by the sandbox iptables rules (blanket UDP REJECT)
• Even after DNS resolves, direct TCP 443 connections are also REJECT'd, so WebSocket libraries that don't use the proxy cannot connect
• This affects multiple reported issues: OpenShell Sandbox Networking Fails #642, CoreDNS unreachable inside sandbox (10.43.0.10:53 connection refused) on both macOS and Linux #504, and partially NemoClaw#409
• I built and tested a fix that adds targeted iptables ACCEPT rules for DNS (UDP 53) and configurable direct TCP 443 endpoints, with IP forwarding and MASQUERADE for return routing
• The fix is minimal and preserves the default deny-all security model — only explicitly listed hosts get direct access
• Tested end-to-end: Slack Socket Mode now connects successfully from inside the sandbox

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md