Experimental TLS Termination for Sandbox Runtime [EXPERIMENTAL]

// In a programmatic SDK / harness integration:
{
  network: {
    tlsTerminate: {
      caCertPath: "/path/to/ca.crt",  // optional — omit to generate an ephemeral CA
      caKeyPath:  "/path/to/ca.key",
    },
    filterRequest: (request) => {
      // request is a web-standard Request object
      if (request.url.includes("evil.com")) return { action: "deny", reason: "blocked domain" };
      return { action: "allow" };
    }
  }
}