Scouts: custom network access mode with a per-scout domain allowlist

Problem A scout's network access is a two-way switch: trusted (the platform's trusted-domain allowlist: PostHog, GitHub, package registries, cloud infra) or full (unrestricted egress). That shipped in #76342, which deferred a user-supplied allowlist as the follow-up. The gap shows up as soon as a custom scout needs one or two external sources. A scout that reads a vendor status page, a public docs site, or an API the team owns has to be flipped to full, which hands an unattended agent the whole internet to get one domain. The trusted list cannot be extended per scout, and there is nothing in between. Where the current behaviour lives: • SignalScoutConfig.network_access and its NetworkAccess choices in products/signals/backend/models.py. The docstring already reserves a custom value and asks that it mirror the Tasks vocabulary. • _spawn_and_run in products/signals/backend/scout_harness/runner.py maps the mode to a per-team internal sandbox environment by name …