Configure egress access for golden snapshot preparation #2358

Golden preparation may need network access that the actors created from its snapshot should never receive. For example, an RL environment might fetch repositories and datasets during preparation, then run many actors with those files already available and no external network access. Keeping preparation permissions separate from runtime permissions makes that possible.

The golden is a controller-managed actor with its own identity. Since the template already describes how to prepare the golden snapshot, it is also the natural place to declare the network access that preparation requires:

goldenEgressPolicy:
  rules:
    - https:
        hostnames: [assets.example.com]

With goldenEgressPolicy, the controller creates the golden actor and its policy atomically, before initialization starts. A separate policy request would require the caller to discover the internal actor and coordinate with its startup. Declaring the policy on the template handles that ordering within the component that already owns it.

I think this is the simplest API for this requirement because it adds one optional field and reuses the existing egress rules, validation, defaults, and enforcement. Actors restored from the snapshot receive their own identities and start without an egress policy, so preparation permissions do not become implicit runtime permissions.

Requiring a full EgressPolicy would also require metadata that the controller already knows how to generate.

Related to #1324 but mostly complementary. Implementation: #2159.