Add msb support for cloud-gov acq kit wildcard egress #407

Summary

The new cloud-gov acq kit needs all cloud.gov subdomains to be reachable. The kit currently uses the neutral allow-list entry **.cloud.gov:443, which is suitable for sbx translation, but msb support should not be declared until acq translates per-kit **. wildcard entries into msb suffix net rules.

Why this is tracked

This is deferred backend-parity work for integrations/isolation/acq-kits/cloud-gov/. The kit is intentionally registered for sbx only until this lands.

Acceptance criteria

• acq translates per-kit caps.network.allow entries like **.cloud.gov:443 to the correct msb suffix net-rule form.
• A live or adapter-level msb verification proves api.fr.cloud.gov and representative cloud.gov subdomains are reachable from a sandbox using the cloud-gov kit.
• integrations/isolation/acq-kits/kits.yaml can add msb to the cloud-gov backend list with evidence.

Trigger

Pick this up after the cloud-gov kit PR lands and before advertising msb support for that kit.