fix(permissions): validate network access flow

crates/domain/src/permission.rs

@@ -922,11 +922,12 @@ pub trait PermissionProjector: Send + Sync {
 
     /// Computes the projection.
     ///
-    /// `eff == None` ⇒ the **empty** projection ([`PermissionProjection::empty`]):
-    /// we keep the CLI's native prompting (the product invariant of [`resolve`]).
+    /// `eff == None` means no filesystem/bash policy is projected. Implementations
+    /// may still project orthogonal system permissions, such as network env.
     fn project(
         &self,
         eff: Option<&EffectivePermissions>,
+        network: Option<crate::system_permissions::NetworkPolicy>,
         ctx: &ProjectionContext,
     ) -> PermissionProjection;