e2e: add group-switch scenario using a short tunnel-cache TTL

StartProxy now accepts env overrides so a test can set a short
NB_PROXY_TUNNEL_CACHE_TTL and observe authorization changes propagate in
seconds instead of the 5-minute default.

Add TestGuardrailGroupSwitchTakesEffectAfterTTL: a client starts in group A
(allowed modelA) with a second policy granting group B modelB. After moving the
peer A -> B via the API, once the short tunnel-cache TTL expires the proxy
re-validates, the guardrail decision flips (modelB served, modelA denied), and
the cross-group deny is enforced by management's per-policy/group check.

e2e/harness/proxy.go

@@ -38,7 +38,11 @@ type Proxy struct {
 // network, registered via the given account proxy token and serving the
 // AgentNetworkCluster over a self-signed wildcard cert. It does not wait for
 // peer connectivity — callers poll management for the proxy peer.
-func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, error) {
+// StartProxy launches the reverse-proxy container. Optional envOverrides are
+// merged into the container environment after the defaults, so callers can set
+// or override any NB_PROXY_* var (e.g. NB_PROXY_TUNNEL_CACHE_TTL for tests that
+// need a short authorization-cache window).
+func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverrides ...map[string]string) (*Proxy, error) {
 	root, err := repoRoot()
 	if err != nil {
 		return nil, err
@@ -93,6 +97,12 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, er
 		WaitingFor: wait.ForLog("Initial mapping sync complete").WithStartupTimeout(90 * time.Second),
 	}
 
+	for _, ov := range envOverrides {
+		for k, v := range ov {
+			req.Env[k] = v
+		}
+	}
+
 	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: req,
 		Started:          true,