fix(egress): pre-gate criticals — filter mode 0600, smoke network poisoning, unanchored user ERE

[jraicr]

Summary

Fixes three release-blocking defects in the contained-mode egress jail found by a pre-gate audit of the v0.4.0 scope (dev vs main), each empirically verified against the real drydock-egress image, plus a missing CHANGELOG entry for #159. Part of #149 (release gates G1/G2 should run on top of these fixes).

1. Generated egress filter was mode 0600 — sidecar could not read it (9bdd344)

_generate_egress_filter (lib/compose.sh) wrote the filter via mktemp (always 0600) and mv -f preserves the mode. The file is bind-mounted :ro into the sidecar, where tinyproxy runs as uid 100 with cap_drop: ALL (no DAC_OVERRIDE): tinyproxy printed filter file: Permission denied and exited, the healthcheck never passed, and depends_on: service_healthy aborted every contained-mode run. The identical bug existed in _write_filter (scripts/egress-smoke.sh), so gate G2 died with a misleading "sidecar did not become healthy". Fix: chmod 644 before the file reaches its final path, in both places (the filter is non-secret allowlist data). New bats tests assert the 644 mode through the real code paths.

2. Smoke run pre-created production networks without compose labels (5a4571b)

egress-smoke.sh created drydock_internal/drydock_egress via docker network create when absent and never removed them. A later docker compose up referencing the same fixed name: fails fatally (network ... has incorrect label com.docker.compose.network). Since setup-gates.sh runs G2 before the G1 capture sessions, the gate host was left persistently broken for every subsequent contained run. Fix: the script now tracks exactly the networks it created (SMOKE_CREATED_NETWORKS) and _cleanup (EXIT trap, covers failure paths and SIGINT) removes exactly those — pre-existing networks are never touched, and the host returns to its prior state by construction. Hand-built compose labels were rejected: compose v2 validates com.docker.compose.network against its own project metadata, so an approximated label set could silently re-poison under a future compose version. The EXIT trap moved from top level into main() so sourcing the script (bats) registers no trap. New test/egress_smoke.bats covers created-only cleanup, pre-existing preservation, and trap registration.

3. Bare-hostname user allowlist entries were unanchored ERE (b99dcee, ad40664)

tinyproxy matches FilterType ere patterns as unanchored substrings: the documented user-extension form (echo "example.com" >> ~/.config/drydock/egress-allowlist) produced a pattern that also matched example.com.evil.io and example1com.net — the classic exfil-subdomain shape, undermining the jail's deny-by-default intent for exactly the external-ingestion sessions it targets (INV-9). Fix: a new _normalize_egress_patterns step between comment-strip and dedup anchors any line consisting only of letters, digits, dots, and hyphens as an exact escaped match (example.com → ^example\.com$); any other line passes through verbatim as raw ERE (expert escape hatch — shipped baseline lines are already anchored and pass byte-identical; egress-capture.sh enable's .* allow-all is preserved). Applied uniformly to baseline, global, and per-project sources so bare and anchored duplicates dedup to one line. Docs and baseline header state the exact rule. New tests cover anchoring, verbatim passthrough, baseline stability, dedup collapse, and (previously untested) per-project allowlist inclusion.

CHANGELOG (fc86c24)

Adds the missing user-facing [Unreleased] entry for the Docker-daemon fail-fast probe (#159, DRYDOCK_DOCKER_PROBE_TIMEOUT) and a Fixed section for the three items above.

Invariant impact

• INV-9 (egress jail): strengthened, not softened. The deny-by-default allowlist rule is unchanged; add-only semantics are preserved (normalization never removes baseline lines; dedup keeps the baseline copy). Fix 1 makes the documented jail actually start; fix 3 makes user extensions match exactly instead of as substrings.
• INV-8: untouched — no capability, mount, or hardening change; the filter remains a single :ro bind-mounted plain file, now world-readable (non-secret).
• All other invariants: not touched.

Verification

• Full suite via scripts/test.sh: 1177/1177 pass (includes the new tests; each fix was implemented test-first).
• shellcheck, shfmt -d, scripts/lint-commits.sh: clean.
• Fresh-context adversarial review verdict: READY-WITH-NITS; both nits (doc-precision) addressed in ad40664.