== Enclave dedicated-IP egress demo ==

ports (NAN_PORTS):  http:8000=42899,tcp:7777=34959
egress (NAN_EGRESS): socks5h://0x011a2a5bd849117c6a16a527d2c698be51511bb1817f22993ea91d8a9e69ec55:****@127.0.0.1:1080

[1] identity (SOCKS BND.ADDR, platform-derived):   2a01:4f9:c013:9b52:cc0d:cde5:2209:5f14
[2] explicit egress fetch (icanhazip.com):        internet sees 2a01:4f9:c013:9b52:cc0d:cde5:2209:5f14
[3] transparent fetch (unmodified std::net):        internet sees 2a01:4f9:c013:9b52:cc0d:cde5:2209:5f14
    -> matches [1]: outbound is transparently source-tagged (phase 2 live)

[4] loopback dial 127.0.0.1:8080: DENIED (Permission denied (os error 2)) — raw network closed ✓
[4b] same dial via connect_timeout: phantom Ok, first I/O fails (Socket not connected (os error 53)) — denial holds

On an egress-enabled enclave with the phase-2 toolchain: [1] == [2] == [3],
[4] denied — one stable IPv6 identity in both directions (this page is served
on that same address via the tcp6-relay), with no way to egress off-identity.