Join Squid's systemd Service to the Existing Egress Namespace

For a namespace already available at /run/netns/proxy-egress, merge this into the existing Squid service drop-in:

[Service]
NetworkNamespacePath=/run/netns/proxy-egress

Order the service after the component that creates the namespace. The setting creates neither the namespace nor its interfaces, addresses or routes.

Both listener and onward sockets now exist there. Clients need a path to that listener and its retained access policy; host loopback is not automatically namespace loopback.

Resolver files need separate attention. Unlike ip netns exec, this network setting does not mount /etc/netns/NAME files over their usual paths. When the deployment needs its namespace resolver file:

BindReadOnlyPaths=/etc/netns/proxy-egress/resolv.conf:/etc/resolv.conf

Use resolver addresses reachable from that namespace and merge with existing sandbox/filesystem rules. Binding only Squid's outgoing source address does not place the process in this context.