#3385 feat(devel): allow buf.build egress in the sandbox kit

Adds buf.build:443 to the Docker Sandboxes kit egress allowlist so protobuf code generation works inside the sandbox. The Buf Schema Registry is dialed by make api / buf generate to resolve both the buf.yaml module dependencies and the remote plugins declared in the buf.gen.yaml files.

AI disclosure: this change was produced with the assistance of Claude Code.

🤖 Generated with Claude Code