feat(egress): fastlet Sandbox Actions handler protocol for fleet profile (OSEP-0022) - #1678

…ions protocol

The fleet profile no longer reads the slot store, so both test scripts
register subjects through SET_BINDING / LIFECYCLE_HOOK / REMOVE_BINDING
instead of writing slot files:

- smoke-fleet.sh: set_binding/lifecycle_hook/remove_binding helpers posting
  action envelopes to /_fastlet/v1/actions; deny-first asserted at SET_BINDING,
  activation at data-plane-ready; rebind via a new identity fence; restart
  recovery via instanceId replay; dropped the resolv.conf and per-sandbox
  netns OUTPUT assertions (layers removed); MITM phase re-registers through
  actions
- e2e-fleet-firecracker.sh: bind_subject/activate_subject replace write_slot;
  policy rides the binding input; removed the slot-store/resolv volumes and
  env from both containers
- firecracker e2e doc: contract updated to the actions protocol

fix(egress): encode binding input as a JSON string in the smoke/e2e actions envelopes

fix(egress): inline curl in wait_for checks (shell functions are not visible in bash -c)

…ndbox-group#1678)

Addresses the four P1s and the P2 from the review:

- /policy pushes for a StateDenying subject are stored as the pending policy
  instead of applying immediately: the lifecycle barrier (data-plane-ready)
  is the only activation signal. Cached pushes flushed at SET_BINDING now
  land AFTER the binding input's pending store, so the newer pushed policy
  wins and still waits for the Hook.
- data-plane-ready peeks the pending policy instead of consuming it: a
  transient nft failure keeps it in place, so the Fastlet's retry of the
  same Hook succeeds instead of 409-ing forever.
- LIFECYCLE_HOOK is fenced against the registered identity: a delayed Hook
  from a previous instance can no longer consume the replacement sandbox's
  pending policy or activate it before its own data plane is ready.
- REMOVE_BINDING keeps the subject registered until terminal enforcement
  cleanup succeeds: a retried removal resumes cleanup instead of returning
  success with stale kernel rules. OnUnloaded removes nft first so a
  failure leaves every teardown step undone (no double gateway release).
- gateway DNS redirect ownership is keyed per subject (not refcounted per
  gateway): duplicate SET_BINDING delivery is a no-op, a gateway move on
  rebind releases the old gateway, and one unload fully releases it.

New tests: push-while-denying barrier, data-plane-ready retry after nft
failure, stale-Hook fence rejection, REMOVE_BINDING retry after nft failure,
duplicate-registration gateway idempotency, and gateway-move rebind.

…opology (opensandbox-group#1699)

On the fast-sandbox Firecracker bridge topology
(net.bridge.bridge-nf-call-iptables=1), frames entering the bridge destined
to the bridge itself are pulled into the IP stack with skb->dev = the BRIDGE
(not the pod-side veth). Every dispatch rule matched
'ip saddr <ip> iifname <hostVeth>', so NOTHING matched: no prerouting mark,
no forward dispatch — all IP-direct traffic fell to the fail-closed tail and
was dropped. DNS stayed fine (REDIRECT -> INPUT never touches forward) and
the gateway was reachable (INPUT), exactly matching the reported symptoms.

Verified on a real bridge topology in a container: with the veth's iifname
the rules never fire (no mark -> tail drop); with the bridge name they do.
Removing iifname entirely makes the mark-based fix work end to end.

- fleetnft writeDispatchRule: all jumps/drops match the source IP only
  (forward dispatch, prerouting mark jump, MITM input dispatch, gateway
  drop). Source-IP unforgeability rests on IPAM + no NET_ADMIN/NET_RAW and
  Pod netns rp_filter strict mode.
- iptables gateway MITM: per-subject DNAT/return rules drop the iifname
  (MitmRedirectEntry.HostVeth removed).
- smoke-fleet.sh: shape assertions updated; the forged-IP test now asserts
  the observable consequence (not dispatched to the forging subject) instead
  of the removed iifname rejection.
- docs/OSEP: dispatch-key notes updated.

The SET_BINDING input is the authoritative desired value: data-plane-ready
must apply exactly what the binding carried. A runtime /policy push for a
still-denying subject previously overwrote the pending policy
(storePendingPolicy in resolvePolicyPush), so a create-with-allow binding
could be silently replaced by a deny push and data-plane-ready would activate
the wrong policy — DNS stayed NXDOMAIN while the nft allow set was correct
only after a later update.

resolvePolicyPush now accepts (202) pushes for denying subjects without
touching the pending policy; pushes take effect only when the subject is
active (in-place apply) or via the registration flush of an already-active
subject. Tests updated: the flush no longer overrides the binding input.

…p#1704)

serveDNS swallowed every WriteMsg error, so a query that was handled and
decided (even forwarded and answered upstream) could have its reply die
between the proxy socket and the client with zero signal — the silent
no-answer windows reported for guest-originated DNS. Route all five reply
sites through writeReply: failures now increment egress.dns.reply.failed_total
{stage} (bounded: malformed/unknown_source/deny/upstream_error/answer) and log
[dns] reply write failed with remote address and query name.