Add local proxy response sandbox

[ictechgy]

Summary

• add explicit context-guard experiments serve local-proxy --response-sandbox mode for agent-facing compact response envelopes
• store safe UTF-8 upstream response text as sanitized local artifact receipts and return contextguard-artifact:<id> plus rehydration command templates instead of raw response bodies
• keep default proxy forwarding unchanged; block binary/non-UTF-8, sensitive, oversized, auth/startup, and transport/protocol failure cases from artifacting
• extend diagnostic rows with artifact handle/id/hash metadata only, with no raw body/header/nonce/path leakage
• update docs/changelog and synced plugin copy

RALPLAN evidence

• Architect R1: ITERATE, requested binary/text policy, HTTP status policy, exactness wording, leak checks, and narrow envelope
• Architect R2: APPROVE, blockers none
• Critic: APPROVE, blockers none

Validation

• local-proxy subset: 17 tests OK
• python3 scripts/sync_plugin_copies.py --check — OK
• python3 -m py_compile context-guard-kit/experimental_registry.py plugins/context-guard/bin/context-guard-experiments tests/test_context_guard_kit.py — OK
• targeted response sandbox + docs tests — OK
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/prepublish_check.py --skip-tests — OK
• python3 scripts/release_smoke.py --timeout 20 — OK
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/prepublish_check.py — 695 tests OK + prepublish OK
• git diff --check — OK

Claim boundary

This remains a local-only loopback response artifact sandbox. It does not support external forwarding, credential persistence, CONNECT/TLS proxying, or hosted token/cost savings claims.

[ictechgy]

G003 final validation / quad review loop complete.

Final head: eeac2d78895cb8dfab067922d2dd0fbc2fc3ded8

Validation evidence:

• python3 scripts/sync_plugin_copies.py --check OK
• python3 -m py_compile tests/test_context_guard_kit.py context-guard-kit/experimental_registry.py plugins/context-guard/bin/context-guard-experiments OK
• Targeted ready-file diagnostic + response-sandbox tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest -k local_proxy_serve tests.test_context_guard_kit.ClaudeTokenKitTests OK (7 tests)
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/prepublish_check.py OK (695 tests + prepublish check)
• git diff --check OK

GitHub checks:

• test-and-prepublish (3.11) SUCCESS
• test-and-prepublish (3.12) SUCCESS
• test-and-prepublish (macos-latest, 3.12) SUCCESS

Quad review R2:

• Codex: APPROVE, blockers none (.omx/artifacts/quad-review-pr204-r2-codex-20260615T033050Z.md)
• Claude: APPROVE, blockers none (.omx/artifacts/quad-review-pr204-r2-claude-20260615T033108Z.md)
• Forge: APPROVE, blockers none (.omx/artifacts/quad-review-pr204-r2-forge-20260615T033135Z.md)
• Agy: APPROVE, blockers none (.omx/artifacts/quad-review-pr204-r2-agy-20260615T033200Z.md)

Ready for squash merge.