[codex] Harden egress exfiltration checks

[RedBeret]

Summary

• harden Hermes and OpenClaw egress guards against obvious network exfiltration patterns
• block credential-like file uploads via curl/wget
• block env/credential output piped to network clients
• block secret-like query parameters and literal bearer tokens
• add smoke coverage for curl -d @.env being blocked

Validation

• bash scripts/smoke-test.sh
• bash scripts/publish-check.sh -> passed with existing advisory warnings for historical author review and missing local dependency audit tool