Verify QUIC/HTTP3 (UDP/443) fails closed under the sandbox #815

OpenCode 2.1.3 ships with Bun 1.4.4, whose changelog includes HTTP/3 fixes. cplt's proxy is a TCP CONNECT proxy, which cannot carry QUIC over UDP/443.

Verify on macOS (Seatbelt) and Linux (Landlock):

• Under cplt, UDP/443 egress is blocked and fails closed.
• OpenCode falls back to TCP through the proxy.
• The egress allowlist still applies.

Note that Landlock is port-based only; check whether it restricts UDP at all.

Add a test that covers both platforms.