fix: make grant additive + surface real enclave errors

[FiscalMindset]

What & why

Fixes #2 and #3 from my improvement list — two operational gotchas that cost real diagnosis time this week (both hit firsthand).

#2 — grant no longer clobbers the egress allowlist

T3 replaces allowedHosts on every agent-auth update, so granting hosts one at a time silently dropped earlier ones (they'd start returning egress_denied mid-session). grantEgress now unions new hosts with the previously-granted set (cached per tenant in .blindfold/egress-hosts.json) and sends the full list. grant prints the complete authorized set; grant --replace forces a reset.

Verified: after seeding, granting api.twilio.com alone →

Contract is now authorized to call ALL of: api.github.com, api.stripe.com,
api.twilio.com, generativelanguage.googleapis.com, httpbin.org, s3.us-east-1.amazonaws.com

#3 — the proxy surfaces the real enclave error

Forward failures were swallowed as internal proxy error (a generic 500), hiding the actual cause. The proxy now returns the real T3 error as JSON with an actionable hint.

Verified (hitting an ungranted host):

{
  "error": "blindfold_forward_failed",
  "status": 400,
  "code": "bad_request",
  "detail": "http::call: host/http.egress_denied: host 'api.anthropic.com' is not in the authorised_hosts allowlist",
  "request_id": "4d5fb1df-…",
  "hint": "Egress is not authorized for 'api.anthropic.com'. Run: blindfold grant --host api.anthropic.com …"
}

Hints cover egress_denied, fuel_per_minute (rate limit), secrets-ACL, and JSON-payload. Granted-host happy path unchanged (github → 200).

Notes

• .blindfold/egress-hosts.json is gitignored. No secrets committed.
• integration-stack.md gotchas updated to "fixed".

---

Summary by cubic

Makes egress grants additive and surfaces real enclave errors with clear, actionable hints. Prevents dropped hosts during grants and replaces generic 500s with accurate statuses.

• Bug Fixes
  • grant now unions new hosts with the cached set per tenant (.blindfold/egress-hosts.json) and sends the full allowlist; prints the complete authorized set; --replace resets.
  • Proxy returns T3 errors as JSON with status, code, detail, request_id, and a hint; maps egress_denied (suggests exact grant), fuel_per_minute (429/retry), secrets ACL (suggests blindfold init), and JSON-payload issues (use query params).
  • Docs updated; the cache file is gitignored.

^{Written for commit f2db86d. Summary will update on new commits.}