feat: harden firewall policies telemetry and operations

Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.

scripts/ci/linux-agent-fixture.py

@@ -0,0 +1,60 @@
+"""Isolated namespace-only control-plane fixture for the shipped Linux agent."""
+import http.server
+import json
+import pathlib
+import sys
+import socket
+import threading
+
+root = pathlib.Path(sys.argv[1]) if __name__ == "__main__" else pathlib.Path(".")
+policy = {
+    "hash": "sha256:" + "1" * 64, "generation": 1, "apply_version": 2,
+    "default_action": "accept", "deny_cidrs": ["198.18.0.2/32", "2001:db8:1::2/128"],
+    "allow_cidrs": [], "port_rules": [], "sync_interval_sec": 60,
+}
+
+
+def acknowledgement(report):
+    """The shipped durable sender only dequeues an exact ID+sequence ACK."""
+    return {"ok": True, "accepted": True, "report_id": report.get("report_id"), "sequence": report.get("sequence")}
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/v1/agent/policy":
+            result = dict(policy)
+            if (root / "invalid").exists():
+                result.update(hash="sha256:" + "2" * 64, deny_cidrs=["invalid-prefix"])
+        else:
+            result = {"ok": True}
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(json.dumps(result).encode())
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length", 0))
+        if length > 1024 * 1024:
+            self.send_error(413)
+            return
+        report = json.loads(self.rfile.read(length))
+        with (root / "reports.jsonl").open("a") as handle:
+            handle.write(json.dumps(report) + "\n")
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(json.dumps(acknowledgement(report)).encode())
+
+    def log_message(self, *_):
+        pass
+
+
+class IPv6Server(http.server.ThreadingHTTPServer):
+    address_family = socket.AF_INET6
+
+
+if __name__ == "__main__":
+    server = http.server.ThreadingHTTPServer(("0.0.0.0", 0), Handler)
+    server6 = IPv6Server(("::", 0), Handler)
+    (root / "port6").write_text(str(server6.server_port))
+    threading.Thread(target=server6.serve_forever, daemon=True).start()
+    (root / "port").write_text(str(server.server_port))
+    server.serve_forever()