Evolution policy proposer gets the sandbox's real network rules (first candidate wrongly claimed PyPI and Hugging Face were blocked); deploy-when-idle.sh waits for the round and the worker before deploying