Support host service ports in network-isolation mode

[lpcox]

Problem

Related to github/gh-aw#52140.

gh-aw compiles workflow services: port mappings into AWF's --allow-host-service-ports option, but the option is currently ineffective when AWF runs in the default network-isolation mode. Its implementation relies on host iptables, while isolation mode enforces egress through Docker network topology without host iptables or sudo.

As a result, sandboxed agents cannot reach declared service containers through the documented host.docker.internal:<port> address. The hostname is also not mapped in the agent container, so it neither resolves nor has a route. This leaves no supported strict-mode configuration where an agent can access workflow services.

Potential solution

Implement --allow-host-service-ports natively for network-isolation mode while preserving the secure default:

• Add a host-gateway mapping for host.docker.internal to the agent container when host service ports are configured.
• Permit agent traffic to the host gateway only on the explicitly declared TCP ports; keep all other host access blocked.
• Apply the restriction through the isolation-mode Docker/network enforcement path rather than falling back to legacy host iptables or enabling broad host access.
• Reject or clearly report configurations that request host service ports when selective routing cannot be established.
• Add integration coverage proving an isolated agent can reach an allowed service port, cannot reach undeclared host ports, and can resolve host.docker.internal.

Acceptance criterion: the unchanged github/gh-aw smoke-service-ports workflow succeeds under strict: true without enabling sudo or legacy host-access mode.