🐛 fix: Resolve Packaged Pipe Addon Inside Guests

[dustinhealy]

This implements the guest-entrypoint workaround documented and validated by LeonardSEO in #320. twltwk independently documented the same guest addon-path problem in #329. This PR adds the image regression tests and CI coverage across the three guest rootfs families.

When a runner copies its guest rootfs, the native pipe addon remains at /usr/local/lib/anonymous-pipes.node, but the build stage's SANDBOX_PIPE_ADDON Docker environment setting is lost. The API becomes healthy, then real execution fails while looking for /sandbox_api/.build/anonymous-pipes.node.

Set the installed addon default in the shared guest entrypoint, after the VM/chroot boundary. An explicit guest value is preserved. This covers the standalone API, combined worker, and launcher rootfs families without depending on environment forwarding across the VM boundary.

Add an image regression test that starts the installed entrypoint and bundled API, rejects unsigned requests, and executes a signed shell job through NsJail while checking stdin, stdout, and stderr. It tests unset, empty, and overridden addon paths; the override case moves the addon away from the default location. CI runs it against the production guest rootfs stages, including both architectures in the existing launcher IPC job.

Validation:

• Reproduced the exact missing-module failure on the unmodified launcher guest image after its startup smoke test and health endpoint passed.
• All nine execution cases passed locally on Linux arm64: three addon settings across api/Dockerfile:sandbox-build, docker/Dockerfile.worker-sandbox:sandbox-rootfs, and launcher/Dockerfile:sandbox-build. Unsigned requests returned 401 in each case.
• Shell syntax, CI YAML parsing, and git diff --check passed.
• CI guest execution checks passed for the API and worker roots on amd64 and the launcher root on amd64/arm64, along with API unit tests, launcher unit tests, and the existing IPC tests.
• The guest-rootfs CI tests run in disposable containers with no network access. Cgroup delegation is disabled for those Docker tests; NsJail namespaces, per-job identities, seccomp, and the supervisor filter remain enabled.
• Final baked-image KVM smoke test passed on exact commit b29cefb3af79b0767f94988bedc5c5d030ec0703. Built api/Dockerfile:sandbox-runner-true, booted its read-only ext4 disk through libkrun, and executed signed Python 3.14.4 and Node 24.15.0 jobs. Both returned HTTP 200 and exit code 0 with the expected stdin, stdout, stderr, and FIFO descriptors. Python asyncio.to_thread also passed; unsigned requests returned 401. The launcher held real KVM VM/vCPU descriptors, and execution reported guest kernel 6.12.91. Cgroup v2, per-job identities, hardened mode, and seccomp remained enabled. The run artifact contains boot logs, execution responses, and source/image/disk provenance.
• The first KVM harness attempt failed while reading a published-port mapping on an internal Docker network. The corrected harness uses the private bridge address and passed a networking preflight before the successful run.
• Codex review completed with no findings on exact commit b29cefb3af79b0767f94988bedc5c5d030ec0703.

Fixes #320
Fixes #329

[pretender-extra]

Same change has been running on our self-hosted v1.10.4 Docker Compose deployment since 11 Oct; jobs work normally.

[dustinhealy]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T02:08:37.528506Z	b29cefb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: b29cefb3af

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[twltwk]

Thank's all 👍🏻