Add Network Door and Native Assistant Door CLI surfaces

[mdheller]

Summary

Adds non-mutating sourceosctl operator surfaces for the Network Door, Firewall Door, Mesh Door, BYOM provider, and Native Assistant Door contract family now defined in SourceOS-Linux/sourceos-spec.

Commands

sourceosctl network doctor
sourceosctl network plan --destination models.enterprise.example
sourceosctl network plan --enterprise --mesh --allow-listed --destination models.enterprise.example
sourceosctl network provider --provider-class openai-compatible --owner user
sourceosctl network evidence inspect ./network-evidence.json
sourceosctl native-assistant plan --operation open-workroom
sourceosctl native-assistant plan --operation create-office-artifact --prompt 'draft local report'

Safety posture

This slice is plan/probe only. It does not:

• mutate firewall state;
• install service mesh components;
• contact external model providers;
• store or print provider credentials;
• invoke Siri, Apple App Intents, Shortcuts, Android intents, Windows shell APIs, browser extensions, or MCP/native transports;
• send prompts off device.

Destination labels and prompt text are emitted as SHA-256 hashes only.

Contract alignment

• NetworkAccessProfile
• FirewallBindingProfile
• MeshBindingProfile
• ExternalModelProviderProfile
• NativeAssistantBridgeProfile

Changes

• Adds sourceosctl/commands/network.py.
• Adds plugin-style entrypoint routing in bin/sourceosctl.
• Adds tests for network, provider, evidence, and native assistant bridge plans.
• Adds integration boundary docs.
• Updates README command surface and default refs.

Validation

Expected repo validation:

make validate