Improve segmentation egress boundary evidence

[DENGXUELIN]

Closes #1685.

Summary

• add an egress boundary and internet exit evidence gate to segmentation
• require approved destination, enforcement point, DNS path, route/bypass, logging, and exception lifecycle evidence
• add vulnerable and benign fixtures for broad NAT/port-only egress versus constrained egress boundaries

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• added-line ASCII check
• content marker check for SEG-EGRESS-* findings and fixtures
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate, USD 100 if accepted.