fix(policy): allow credentialed L4 GitHub endpoints in default policies

[russellb]

What

Mark the plain L4 github.com and api.github.com endpoints in the default sandbox policies as allow_uninspected_credentials: true.

Affected policies: base, droid, gemini, pi, ollama.

Why

These policies list github.com / api.github.com as plain L4 (uninspected) endpoints in rules such as pypi, copilot, and the agent rules. On their own that is fine. But when a GitHub credential provider is attached to a sandbox, the gateway marks every endpoint that reaches a credentialed host as a credentialed endpoint and rejects any that are L4-only (to stop an injected token leaking over an uninspected connection).

The result: on a provider-backed sandbox, any openshell policy set or openshell policy update fails — even when the change is unrelated to GitHub — with:

credentialed endpoint 'github.com:443' in rule 'pypi' uses L4-only; configure L7 inspection or explicitly set allow_uninspected_credentials: true

This is the root cause behind NVIDIA/OpenShell#2998 for users who create a sandbox with a GitHub provider on the default policy.

Approach

These endpoints are intentionally uninspected — uv downloading python-build-standalone release assets, Copilot auth/user management, and agent binaries fetching updates from GitHub release assets. Setting allow_uninspected_credentials: true makes that intent explicit and restores the policies' behavior on provider-backed sandboxes, without changing anything for sandboxes that have no provider attached.

A more restrictive alternative would be to convert each endpoint to L7-inspected rules, but the affected rules bind to binaries (uv/python, copilot, agents) whose GitHub flows include POST (e.g. Copilot device-auth) and non-REST traffic, so an L7 read-only rule would break them. The explicit opt-in is the lowest-risk, behavior-preserving fix; maintainers can tighten specific endpoints to L7 later.

Testing

• python3 -c "import yaml; yaml.safe_load(...)" on all five policies — valid.
• No other endpoints or rules changed; license headers untouched.

Related: NVIDIA/OpenShell#2998

[russellb]

Closing in favor of NVIDIA/OpenShell#3129, which fixes the underlying gateway behavior directly: it makes the credential gate differential so inherited uninspected endpoints from a sandbox's baked default policy no longer block unrelated policy set/policy update edits. That's a better fix than opting these endpoints out of inspection here. This is also mooted by NVIDIA/OpenShell#3116, which retires the community base images and their baked policies. Thanks!