The partner's allowlist has one IP: yours

The partner API allowlists source addresses, and yours is "wherever the job happens to run": CI runners, three laptops, a colleague's cloud function.

hoody-egress is a standard HTTP proxy answering at your container's URL. Point any client at it: curl with -x, pip, npm, a browser through a PAC file: and the request exits from your server's address, the one the partner allowlisted. Nothing to install and nothing to start; the endpoint is live on any Kit container. Set proxy permissions on the egress service before sharing the URL, because an open egress endpoint is an open proxy. Chain an upstream later without touching a single client.

The jobs keep running wherever they run. The exit stops moving.