send agent traffic through squid once its hive announces it

hive-priv-sock/src/lib.rs

@@ -243,6 +243,14 @@ pub struct HiveFacts {
     /// `HIVE_AGENT_NATS_URL`: where the agent reaches the swarm queue, from
     /// `deploy.hive-controller.queue.agentNatsUrl`.
     pub agent_nats_url: Option<String>,
+    /// `HIVE_SQUID_PROXY`: `<bridge IP>:<port>` of this host's squid, which
+    /// checks each agent's proxy credential and applies the agent's
+    /// `unrestricted_internet` flag. Set only by a hive that carries that
+    /// policy; an agent sends nothing through a proxy without it.
+    pub squid_proxy: Option<String>,
+    /// `HIVE_EGRESS_NO_PROXY`: the comma-separated hosts an agent must reach
+    /// directly and never through the squid above.
+    pub egress_no_proxy: Option<String>,
 }
 
 /// Wall-clock bound hive-priv puts on one [`PrivRequest::MeasureAgentDisk`]