test(docker): keep network probes hermetic

[konard]

Closes #160.

Root cause

The original multi-network integration probe combined a private Docker alias check with an unauthenticated request to api.github.com. GitHub applies a 60-request hourly quota by source IP, so a valid HTTP 403 on a shared runner became a nonzero BusyBox wget exit code and blocked the JavaScript release chain.

PR #159 had already removed that public dependency before this prepared branch was created. Its two-local-sidecar replacement fixed the flake, diagnostics, and release, but it no longer exercised the original default-bridge route requirement.

Changes

• start the test container on Docker bridge, attach two internal networks, and verify both local aliases plus the retained default route
• add fast JavaScript and Rust invariants that reject HTTP URLs in the probe
• preserve complete pre-fix/fixed CI logs and related issue, PR, workflow, release, registry, source, diff, and local-test data
• document the timeline, requirements, root-cause chain, alternatives, official research, and verification in docs/case-studies/issue-160
• add the JavaScript changeset and Rust changelog fragment required when their CI policies classify test-suite changes as releasable code

Runtime behavior and public APIs are unchanged. Both package workflows will apply their required patch metadata automatically after merge.

Reproduction and regression

Before: the historical command ping -c 1 formal-ai && wget -q --spider https://api.github.com fails whenever the runner IP has exhausted GitHub anonymous quota, even though Docker connectivity is healthy. The complete failing run is retained at docs/case-studies/issue-160/ci-logs/js-31380353470.log.

After: both suites use only repository-controlled Docker networks. The focused real-daemon tests pass, and the invariant tests fail immediately if an HTTP dependency returns.

Verification

• JavaScript focused Docker integration: 3 passed
• JavaScript full suite: 737 passed, 0 failed
• JavaScript ESLint, Prettier, and file-size checks: passed
• Rust focused Docker integration: 2 passed
• Rust full suite and doc tests: passed
• Rust formatting, Clippy, file-size, release build, and package verification: passed
• JavaScript/Rust test parity and documented examples: passed
• .mjs syntax pre-check: passed
• JavaScript changeset and Rust changelog-fragment validation: passed

This is not a visual/UI change, so screenshots are not applicable.

[konard]

Working session summary

Implemented and finalized PR #161.

• Replaced external network assumptions with hermetic Docker probes in JavaScript and Rust.
• Preserved default bridge-route coverage across two internal networks.
• Added no-HTTP regression invariants and required patch release fragments.
• Added the complete [issue 160 case study](/docs/case-studies/issue-160/README.md), including CI logs, timeline, research, and root-cause evidence.
• Full local JS/Rust suites and repository checks pass.
• Fresh CI on commit 370f142: 30 passed, 6 intentionally skipped, 0 failed.
• PR is ready, mergeable, current with main, and the working tree is clean.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $12.423817

📊 Context and tokens usage:

• 296.2K / 200K (148%) input tokens, 38.5K / 128K (30%) output tokens

Total: (296.2K + 7.7M cached) input tokens, 38.5K output tokens, $12.423817 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: medium (~15999 tokens)
• Model: GPT 5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (3037KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag