feat: Isolation chooses which of an agent's providers a pane may reach

[nyxene]

Closes #58

Network: Only these providers picked whole agents, so a pi pane that only uses DeepSeek could reach every host of pi's 38 providers. Now:

• pi's manifest names its hosts in 36 provider groups (built-in agents only; a user's or plugin's manifest stays all-or-nothing, so plugin abilities and the catalog see only the union as before).
• The Isolation window has Choose providers… under the agent chips: a view with all (48 hosts) and one row per provider with the hosts it opens. A pane saved as pi/deepseek reaches only api.deepseek.com; a saved pi keeps every provider, including ones added later.
• One parser for saved entries. Opening and saving the window, a chip click, Esc or a click outside the view never widen a saved subset; a provider or agent that is gone is shown, dropped on save and never turned into the whole agent.
• A gone provider stops the pane; restore and restart say which pane and why in one notice.
• Messages cards cut a long isolation line at 44 cells.

Narrowing: pi's union goes from 50 to 48 hosts. console.anthropic.com and api.githubcopilot.com are named nowhere in pi-ai 1.3.0 and are gone; whoever reached GitHub's MCP server (api.githubcopilot.com) from a pi pane under Only these providers no longer can. docs/isolation.md: Bedrock works with keys, not SSO or profile login, in such a pane.

No new way out of nerd: the proxy reaches a subset of what it reached; tests/egress.rs unchanged.

Checked:

• Plan with two rounds of architect and critic review (both APPROVE), independent build audit (PASS); the audit's two untested paths now have tests that fail on the mutations it tried.
• Red on today's master: saving a pane or a tab with pi/deepseek unchanged gave ["claude"]; a gone entry became an agent.
• Live, on a test server, by mouse through the window: wrapper --hosts api.deepseek.com;443 only; from the pane api.deepseek.com → 401 (reached), api.openai.com refused with pane 2 proxy: api.openai.com:443 refused: not in the manifest; control with all of pi → api.openai.com 421, allowed; real pi 1.3.0 starts with its models, no prompt sent; reopen + Enter keeps ["pi/deepseek"]; an old saved ["pi"] resolves to 48 hosts.
• scripts/gates.sh exit 0.

🤖 Generated with Claude Code