fix(permissions): validate network access flow

crates/domain/tests/structured_session_d0.rs

@@ -343,6 +343,7 @@ impl AgentSessionFactory for FakeFactory {
         _requester: Option<&str>,
         _env: &[(String, String)],
         _sandbox: Option<&domain::sandbox::SandboxPlan>,
+        _structured_policy: Option<&domain::ports::StructuredProviderLaunchPolicy>,
     ) -> Result<Arc<dyn AgentSession>, AgentSessionError> {
         Ok(Arc::new(FakeSession {
             id: SessionId::from_uuid(Uuid::from_u128(7)),
@@ -398,7 +399,16 @@ async fn fake_factory_supports_only_structured_profiles_and_starts() {
     };
     let cwd = ProjectPath::new("/srv/run").unwrap();
     let session = factory
-        .start(&structured, &ctx, &cwd, &SessionPlan::None, None, &[], None)
+        .start(
+            &structured,
+            &ctx,
+            &cwd,
+            &SessionPlan::None,
+            None,
+            &[],
+            None,
+            None,
+        )
         .await
         .expect("factory starts a session");
     assert_eq!(session.id(), SessionId::from_uuid(Uuid::from_u128(7)));