[Enhancement]: implement WP2 shared transport trust policy

[Qiao-yq]

Description

Context

Part of #3. WP2 ports the shared transport security policy from the accepted PowerContext target to PowerContext Go without changing the OpenAPI contract or copying the Python package layout.

Completed scope

• Add one shared Go transport-trust policy covering localhost, IPv6 ::1, and the complete IPv4 127.0.0.0/8 range.
• Reject plaintext non-loopback Client requests by default, including unauthenticated requests carrying Source or Memory content.
• Permit a non-loopback HTTP label only when the caller supplies its own transport and explicitly vouches that the transport is secure.
• Reject unauthenticated non-loopback Server binds by default.
• Add an explicit operator opt-in for controlled-network or TLS-terminated deployments.
• Apply the policy after CLI host and port overrides have been merged.
• Align every adapter currently present in this repository: Bub, Claude Code, Codex, DSH, Hermes, LangGraph, OpenClaw, OpenCode, and Pi.
• Add drift guards for Client, Server, CLI, Docker/runtime configuration, documentation, and adapter-native test suites.

Acceptance evidence

• All shared loopback vectors are accepted, including addresses across 127.0.0.0/8.
• Plaintext non-loopback Client requests fail closed at construction and at the final RoundTripper, including per-request ogen URL overrides.
• Unauthenticated non-loopback Server binds fail closed by default.
• The Client secure-transport vouch and Server/operator opt-in work and are documented.
• Safe CLI overrides can repair an unsafe environment host; unsafe overrides cannot weaken a safe environment without authentication or opt-in.
• Current retained adapters use the same fixture and policy semantics.
• Unit, integration, adapter, generated-output, race, fuzz, cross-platform, Docker, documentation, license, downstream, and Acceptance checks passed on the submitted Heads.
• No OpenAPI or unrelated generated contract changed.

Delivery

• Client/shared policy: fix(client): enforce shared loopback transport policy #48, merged as 0076eaf2672fb1083f4ad03a4731705dda7b6bac.
• Server/CLI/Docker policy: fix(server): enforce non-loopback bind policy #51, merged as c66d30964b2c4d525d9a832247ea2237b036f4db.
• Current retained adapters: fix(integrations): align shared transport policy #54, merged as 14b783d5e8b1ac418c7d95def930a8ad3716dea2.
• Final verified main Head: 14b783d5e8b1ac418c7d95def930a8ad3716dea2.
• Main: https://github.com/ob-labs/powercontext-go/actions/runs/33259588031
• E2E harness: https://github.com/ob-labs/powercontext-go/actions/runs/33259587965
• CodeQL: https://github.com/ob-labs/powercontext-go/actions/runs/33259587913
• License Check: https://github.com/ob-labs/powercontext-go/actions/runs/33259587975
• Windows contract: https://github.com/ob-labs/powercontext-go/actions/runs/33259587917

Deferred adoption outside this issue

WorkBuddy and LangChain are not currently implemented in this repository. Their P1/P2 implementation remains tracked under WP3/WP4 in #3. When added, they must consume test/transport/testdata/loopback_hosts.json and satisfy the same plaintext, loopback, and explicit-trust contract. This issue does not mark those integrations as implemented.

Non-goals preserved

• Changing openapi/powercontext.yaml.
• Adding a new authentication mechanism.
• Enabling arbitrary public-network access by default.
• Addressing WP3-WP6 feature implementation beyond recording the future adapter adoption requirement.

[AlexStocks]

WP2 is complete for the Go Client, Server/CLI/Docker surfaces, and every adapter currently present in the repository. Delivery and exact-main CI evidence are recorded in the issue body. WorkBuddy and LangChain remain separate WP3/WP4 implementation work and must adopt the shared vectors when added.