Improve firewall effective egress evidence

[DENGXUELIN]

Summary

• Adds an effective egress and temporary-rule evidence gate to firewall-review without removing the existing review workflow.
• Covers cloud effective rules, route/NAT path validation, destination allowlists, stateful return vs outbound initiation, temporary-rule expiry, runtime flow evidence, and exception ownership.
• Adds vulnerable and benign fixtures for proxy-policy bypass via NAT/broad egress versus verified proxy-only egress.

Bounty

Addresses #1580 as an Improver contribution.

Validation

• git diff --cached --check
• Markdown fence-balance check over staged .md files
• Added-line ASCII check
• Required marker check for FW-EGRESS-01 through FW-EGRESS-08
• Sensitive/public-contact pattern scan
• git diff --check origin/main...HEAD
• git merge-tree --write-tree origin/main HEAD