ci: add the Linux-native lane, retire the mothballed netns lane - #697

Un-mothball the UC1 (no-net), UC4 (static ingress), and UC6 (PTask<->PTask
over the gvproxy switch) proofs in crates/minimald/tests/netns.rs, which
lost their CI lane when ci-netns.yml was retired (#697). They drive the
production switch-attach wiring against a real gvproxy switch and need only
unprivileged userns + sudo (no KVM), so they run on a stock ubuntu-latest
runner.

- Add .github/workflows/ci-netns.yml using the current always-triggered +
  in-workflow paths-filter + success-aggregator lane pattern (no
  trigger-level `paths:`). Drops the WireGuard mesh (mesh_uc7) step — that
  `networking-wg` feature is disabled for now.
- Update the netns.rs header and #[ignore] reasons (no longer mothballed).
- Correct the stale "mothballed netns" notes in ci-linux-native.yml.

The three proofs pass locally on this branch (MINIMALD_NETNS_TEST=1
GVPROXY_BIN=... cargo test -p minimald --test netns -- --include-ignored),
confirming the new switch-side ingress gate does not regress UC1/UC4/UC6.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Un-mothball the UC1 (no-net), UC4 (static ingress), and UC6 (PTask<->PTask
over the gvproxy switch) proofs in crates/minimald/tests/netns.rs, which lost
their CI coverage when the standalone ci-netns.yml was retired (#697). They
are Linux-native (DM2) integration tests that need only unprivileged userns +
sudo and a userspace gvproxy switch (no KVM), so they run as a
`netns-integration` job in the existing ci-linux-native lane rather than a
separate workflow / required check.

- Add the `netns-integration` job to ci-linux-native.yml (enable userns,
  fetch the pinned gvproxy, run `cargo test -p minimald --test netns
  -- --include-ignored`); wire it into the lane's success aggregator and add
  the gvproxy pin to the changes filter.
- Un-mothball netns.rs: update the header and #[ignore] reasons.

The WireGuard mesh proof (mesh_uc7, networking-wg) stays out — that feature is
disabled. The three proofs pass locally on this branch, confirming the new
switch-side ingress gate does not regress UC1/UC4/UC6.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(minimald): frame gvproxy forwarder replies by Content-Length

The forwarder control verbs (POST /services/forwarder/expose and the
:7654/:7655 proxy-publish) sent HTTP/1.0 with `Connection: close` and
read the reply to EOF. Over the KVM libkrun `add_vsock_port2(listen =
false)` shuttle, gvproxy's response is dropped when it closes the socket,
so the guest reads 0 bytes ("malformed gvproxy status line") even though
the forward was applied. apply_ingress then rolls back a *successful*
own-ip ingress attach, so the session's shell never starts (gap G-N8);
own-ip without ingress is unaffected.

Send HTTP/1.1 keep-alive (no `Connection: close`) and frame the reply by
Content-Length instead of read-to-EOF, so the server never closes first
and the response drains to the guest, which closes from its own side.
This also repairs the in-VM :7654/:7655 proxy-publish (same leg). The
native unix path (DM2) is unaffected.

Verified live on DM3 (KVM): own-ip + --ingress attach starts the shell
and publishes the lease; TC3/TC4/TC7/TC8 = 200/200/(401+200)/200, with
no startup proxy-publish warnings. Adds a regression test that hangs if
the framing reverts to read-to-EOF.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(minimald): enforce session-to-session ingress and register PTask DNS

Two networking findings from a cross-platform (DM1/DM2) test run:

- #2: switch-side ingress was unenforced. `--ingress` only gated the
  host-loopback publish, so a peer session or the daemon tap could reach
  any port on an own-IP PTask over the shared gvproxy switch (gvproxy has
  no per-client ACL API). Add a stateless TCP-SYN gate to the inbound
  relay leg (`relay_switch_to_tap`): a bare SYN (SYN set, ACK clear) to a
  port not in the target's ingress policy is dropped; established/return
  traffic, egress, and declared ports pass. UDP and non-IPv4 pass through
  (documented limitation). Wires the previously-dead `PolicyWarnLimiter`
  as the R2.7 drop-log site.

- #3 / UC6: a session could not resolve a peer's `*.min.internal` name,
  and the own-IP lease rotates per attach. Register `<session>.<host-id>`
  to the current lease in gvproxy's runtime DNS (POST /services/dns/add)
  on every own-IP attach. gvproxy's resolver is the switch gateway every
  sandbox already queries, so no new resolver or resolv.conf change is
  needed; gvproxy's newest-wins merge picks up a rotated lease with no
  remove verb.

Peers can now reach declared ports on another session by hostname (UC6),
subject to that target's ingress (#2). Verified end-to-end on DM2 (the
name registers to the live lease) plus unit tests for the frame parser
and the DNS request shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build(minimal,minimald): disable ssh-forward and WireGuard mesh

Gate the SSH port-forward and WireGuard-mesh surfaces behind new,
off-by-default features so they compile out for now: UC7, UC2b option A,
and the ssh-forward fallback are deferred (the daemon does not yet consume
mesh enrolment, and ssh-forward's target resolves in the VM/host context
rather than the sandbox).

- New `remote-access` feature on `minimal` gates the `mesh` and
  `ssh-forward` (alias `forward`) subcommands and their plumbing.
- New `ssh-forward` feature on `minimald` gates the `direct-tcpip`
  handler; with it off, a `#[cfg(not)]` stub rejects every forward so the
  daemon fails closed rather than relying on russh's default handler.
- Drop `networking-wg` from the built features (justfile) and remove the
  WireGuard mesh test steps from CI and release. The mTLS reverse proxy
  (`networking-proxy`) is unaffected and stays enabled.

Both crates compile, clippy, and test clean with and without the new
features.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(networking): remove the superseded CLI test-plan

The `test-plan.md` / `test-plan.sh` pair under `03-spec-networking/`
described an earlier DM1/DM2 CLI walk-through and is no longer maintained;
nothing in the build, CI, or code references it. The networking spec,
architecture, and diagram docs remain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(minimald): enforce UDP ingress with per-PTask conntrack

Extends the switch-side ingress gate (finding #2) to UDP, which the
initial TCP-SYN gate left as a documented gap. UDP has no
connection-establishment signal, so a stateless port check cannot tell a
solicited reply (a DNS/QUIC response to an ephemeral port) from an
unsolicited datagram.

Add a per-PTask `UdpConntrack`: the egress relay leg records each outbound
datagram's reverse flow `(remote_ip, remote_port, local_port)`, and the
ingress leg allows a matching reply while dropping UDP to an undeclared
port that matches no flow. Declared UDP ingress ports (the internal port
of a UDP port-mapping) are always allowed. One flow table is shared
between the two relay tasks; entries expire after 120s with an
opportunistic sweep bounding the table.

Refactors the frame parse into `parse_ipv4_l4`, reused by the TCP and UDP
predicates. This closes UC6 for UDP round-trips (a peer reaching a
declared UDP port, and its reply, both work) and completes spec Req 6's
"TCP and UDP subject to target ingress."

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(netns): run the network-namespace proofs in the linux-native lane

Un-mothball the UC1 (no-net), UC4 (static ingress), and UC6 (PTask<->PTask
over the gvproxy switch) proofs in crates/minimald/tests/netns.rs, which lost
their CI coverage when the standalone ci-netns.yml was retired (#697). They
are Linux-native (DM2) integration tests that need only unprivileged userns +
sudo and a userspace gvproxy switch (no KVM), so they run as a
`netns-integration` job in the existing ci-linux-native lane rather than a
separate workflow / required check.

- Add the `netns-integration` job to ci-linux-native.yml (enable userns,
  fetch the pinned gvproxy, run `cargo test -p minimald --test netns
  -- --include-ignored`); wire it into the lane's success aggregator and add
  the gvproxy pin to the changes filter.
- Un-mothball netns.rs: update the header and #[ignore] reasons.

The WireGuard mesh proof (mesh_uc7, networking-wg) stays out — that feature is
disabled. The three proofs pass locally on this branch, confirming the new
switch-side ingress gate does not regress UC1/UC4/UC6.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(minimald): remove dead networking code

Drop three unreferenced networking items found by a workspace-wide
dead-code sweep. All are behaviour-neutral: an identical before/after
run of the native-daemon and KVM-VM networking test plans produced the
same results (in-sandbox isolation, host egress, own-IP egress, managed
DNS proxy, static ingress, and the mTLS reverse proxy all unchanged),
and the network-namespace enforcement proofs stayed green.

- guest.rs: a no-op `let _ = &cidr;` — `cidr` is already consumed by the
  "egress up" tracing call a few lines below, so the borrow-and-drop did
  nothing.
- session_host.rs / session.rs: the `SandboxLauncher::session` field (and
  its unjustified `#[allow(dead_code)]`) was constructed but never read
  and has no Drop side effect; remove it with the now-unused import, the
  struct initializer, and rename the launcher parameter to `_session`.
- net/mod.rs: the `GATEWAY_MAC` re-export had no consumer anywhere in the
  workspace (the switch crate uses its own constant internally).

clippy --workspace --all-targets -D warnings clean; minimald unit tests
pass; ssh-forward / networking-proxy / remote-access gated builds pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTLRizuWQ3GuZmBBv27Nt7

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>