docs: correct kernel proxy (SOCKS) and session-conf allowlist caveats - #446

Go integration tests are skipped on ordinary PR events and run as the required gate in the merge queue. Preview on an internal PR by adding a label: integration-test (Thrift, replay) or integration-test-full (Thrift, passthrough); integration-test-kernel runs the SEA-via-kernel backend against the real warehouse (passthrough). (Label previews cannot run on fork PRs, which lack secret access; fork PRs are exercised by the required merge-queue run.)