feat(msb): neutral ACQ_NETWORK_TIER egress selector + deprecate ACQ_MSB_BALANCED_EGRESS

[wz-gsa]

PR1 of the network-tiers epic (#294). Bret pre-approved this design ("Go for it") on the issue; it went through 7/7 higher-order consensus twice (alias mapping + 3-tier caller) and a 7/7 pre-open review.

Stacked PR: based on fix/sbx-secret-global-empty-array-308 (#309), because that branch fixes a pre-existing macOS bash-3.2 test failure that would otherwise red the test-acq pre-commit/CI gate here. Retarget this PR to main once #309 merges (or merge #309 first). The only extra commit from the base is the network-tier work.

What

Adds the neutral egress selector ACQ_NETWORK_TIER (strict|balanced|open, default balanced) to the msb adapter, implementing the agentic-coding-patterns network-tiers contract (its ADR-0002) for the msb backend. Each tier maps to msb's native egress primitive at provision time; all tiers are deny-by-default except open:

Tier	msb emission
strict	--net-default-egress deny + gateway DNS + the kits' own caps.network.allow hosts ONLY (no curated baseline). GFE / high-assurance.
balanced (default)	deny-default + the curated sbx-balanced baseline (ADR-0018) unioned with the kit hosts.
open	no deny-default (unrestricted egress). Testing only, never GFE; refused unless ACQ_NETWORK_TIER_CONFIRM_OPEN=1 (fail-closed).

ACQ_MSB_BALANCED_EGRESS becomes a deprecated alias, mapped fail-safe (tighter, never looser): 1/on → balanced; 0/off/empty → strict (deny-by-default with kit hosts only — NOT the former permissive no-deny-default behavior; an upgrade never silently loosens egress). ACQ_NETWORK_TIER wins when both are set; a one-time deprecation notice points at the neutral selector. Invalid tier values fail closed to balanced.

Design notes

• The curated baseline emitter _acq_msb_balanced_rules_into is unchanged; only the caller in acq_backend_provision branches three ways (per the approved design — "translate, don't rename").
• The open gate is validated in acq_backend_provision (not at module load), so a stale env var never aborts an unrelated acq invocation — only an actual provision.
• Driving sbx policy from the tier is documented but deferred to a follow-up (PR maps + documents the sbx mapping only). Renaming the msb emitter/ACQ_MSB_BALANCED_EGRESS internals is PR2, coordinated with @mogul.

Testing

• 10 new test-acq cases (10b1j..10b1j10): alias =0→strict, one-time notice, =1→balanced, tier-wins-over-alias, explicit strict, explicit balanced, open-no-confirm fails closed (rc!=0) + names the confirm token, open-confirmed emits no deny-default + warns UNRESTRICTED, invalid→balanced, mixed-case lowercasing. Updated 8n4 and scripts/verify-net-default-egress to the tier vocabulary (only open is now vacuous for the live egress check).
• scripts/test-acq: 868 passed / 0 failed on macOS bash 3.2 (with fix(sbx): make global secret-set bash-3.2-safe (empty-array under set -u) #309's fix in the base).
• shellcheck --severity=warning clean per-file; markdownlint-cli2 clean.

Docs

• docs/BACKEND_GUIDE.md: new "Network egress tiers (ACQ_NETWORK_TIER)" section + tier table + env-var rows (incl. the deprecated alias and the confirm token).
• ADR-0018/0019/0020: network-tiers update banners noting =0 now maps to strict.

Refs #294

AI-assisted (OpenCode).