chore: update OpenAPI spec from monorepo

.speakeasy/in.openapi.yaml

@@ -6561,6 +6561,8 @@ components:
       example:
         type: 'container_auto'
       properties:
+        network_policy:
+          $ref: '#/components/schemas/ContainerNetworkPolicy'
         type:
           enum:
             - 'container_auto'
@@ -6642,6 +6644,46 @@ components:
         - 'last_id'
         - 'has_more'
       type: 'object'
+    ContainerNetworkPolicy:
+      anyOf:
+        - properties:
+            type:
+              description: 'No outbound internet access.'
+              enum:
+                - 'disabled'
+              type: 'string'
+          required:
+            - 'type'
+          type: 'object'
+        - properties:
+            allowed_domains:
+              description: 'Hostnames the container may reach over ports 80/443 (max 50). Entries are lowercase hostnames or glob patterns where * matches any run of characters (e.g. *.example.com). An exact hostname does not cover its subdomains — use a glob or list each hostname. pip needs both pypi.org and files.pythonhosted.org (or *.pythonhosted.org).'
+              example:
+                - 'pypi.org'
+                - 'files.pythonhosted.org'
+              items:
+                maxLength: 253
+                minLength: 1
+                pattern: '^[a-z0-9*]([a-z0-9*-]{0,61}[a-z0-9*])?(\.[a-z0-9*]([a-z0-9*-]{0,61}[a-z0-9*])?)*$'
+                type: 'string'
+              maxItems: 50
+              minItems: 1
+              type: 'array'
+            type:
+              description: 'Outbound access restricted to the listed domains.'
+              enum:
+                - 'allowlist'
+              type: 'string'
+          required:
+            - 'type'
+            - 'allowed_domains'
+          type: 'object'
+      description: 'Network egress policy for the container. "disabled" blocks all outbound internet; "allowlist" permits only hosts matching the listed hostnames or * glob patterns (ports 80/443, DNS via Cloudflare resolvers). The policy is fixed when a container starts: sending a different policy to a warm container fails the request with a 409. Omitted: defaults to "disabled" (no outbound internet). For unrestricted egress, use an allowlist of ["*"].'
+      example:
+        allowed_domains:
+          - 'pypi.org'
+          - 'files.pythonhosted.org'
+        type: 'allowlist'
     ContainerReferenceEnvironment:
       description: 'Reference to a container by its canonical id — a previously returned container_id or a fresh name to create a persistent container.'
       example:
@@ -6655,6 +6697,8 @@ components:
           minLength: 1
           pattern: '^[\w-]+$'
           type: 'string'
+        network_policy:
+          $ref: '#/components/schemas/ContainerNetworkPolicy'
         type:
           enum:
             - 'container_reference'