Clarify allowed external resources (APIs, scraping, packages)

- Official APIs and public data scraping are ALLOWED
- Package installation is ALLOWED
- Only accessing test/validation system is forbidden
- Rule: if a human developer would do it, the agent can too