feat(policy): establish direct TCP egress foundation (#2711)