#943 dsl-compiler must not reach postgres/api (own egress-only network)

EARS: The dsl-compiler service, which executes user Python at compile time, shall have no network route to postgres, the api, or workers. Split from #914 spec line 5. Parent #913.