AgentPod 077: Define Windows network enforcement path

[EfeDurmaz16]

Objective

Complete issue 77 from the AgentPod productization plan: Define Windows network enforcement path.

Why This Matters

AgentPod is the primary product surface. This work moves Agentbox from a collection of runtime/control features toward a credible governed execution product with honest provider boundaries.

Scope

• Epic: Epic 8: Windows Native Path
• Area: policy/network
• Priority: P2
• Expected PR boundary: WFP design/status only

Out of scope: fake provider support, broad rewrites unrelated to this issue, or claims not backed by the verification gate.

Acceptance Criteria

• Behavior, documentation, or contract described by the issue exists.
• Tests, smoke checks, or docs validation cover the change where practical.
• Verification gate passes: docs and status do not claim enforcement until WFP path exists.
• Provider/support level remains honest; descriptor-only and prototype surfaces are not presented as shipped.

Verification

docs and status do not claim enforcement until WFP path exists.

Suggested PR Boundary

WFP design/status only

Source

Derived from docs/agentpod-productization-100-issues.md at commit 33d44f8.