fix(kernel): allow browser CDP endpoints

[rgarcia]

Summary

• allow multi-label onkernel.com CDP proxy endpoints
• allow direct kernel.sh CDP endpoints
• disable the Kernel CLI update check so it does not make a blocked request to api.github.com

Spec choices worth flagging for review

• **.onkernel.com is the v2 multi-label wildcard and covers both api.onkernel.com and regional hosts such as proxy.<region>.onkernel.com.
• *.kernel.sh covers the direct CDP hosts returned by some Kernel browser sessions.
• Credential injection remains restricted to api.onkernel.com; neither CDP destination receives the Kernel API key.
• KERNEL_NO_UPDATE_CHECK=1 suppresses the optional update request instead of broadening the network policy to allow api.github.com.

Test plan

• sbx kit validate ./kernel/
• ./scripts/test-kit.sh kernel
• ./scripts/test-kit-e2e.sh kernel — the fork's scoped sbx daemon is not authenticated to Docker Hub; per the repository docs, fork PR CI also skips e2e because it cannot access the required secrets
• sbx run --kit ./kernel/ claude — blocked by the same Docker Hub login prerequisite

Origin

Ported from kernel/docker-sbx-kit#2.

[mdelapenya]

Merged, thanks!

BTW @rgarcia could you add yourself to CODEOWNERS for kernel? 🙏