fix(ci): isolate agent smoke in namespace-capable helper

docs/runtime-validation.md

@@ -4,7 +4,17 @@ Docker/Linux runtime and RouterOS hardware are unavailable in this Windows works
 
 Local verification: `node --test scripts/ci/sqlite-backup.test.mjs` passed on Windows / Node 25.5.0 (1 test): committed WAL contents, refusal to overwrite a backup, offline restore requirement, removal of stale sidecars and preservation of the old destination when the input is invalid. Windows sandbox denied atomic rename; the identical test passed after an approved sandbox escalation. Bash syntax and workflow YAML parsing passed. These checks do not verify Alpine, Node 22 or the container image.
 
-## Build and publication
+## Containerized Gitea Linux-agent runner correction
+
+The first pushed `linux-agent-smoke` job failed at `unshare: Operation not permitted`: its Gitea job container did not have the kernel capabilities needed by the nested namespace harness. The workflow now builds `scripts/ci/linux-agent-smoke.Dockerfile` and launches it using `linux-agent-container-smoke.sh`. Prerequisites and the checked-out agent/fixture/harness are copied into the helper image, so a remote Docker daemon needs no runner filesystem bind mounts.
+
+The helper has its own network/PID/mount namespaces, `--network none`, a read-only image filesystem and a bounded temporary filesystem. It drops all capabilities except `SYS_ADMIN` (namespace/mount operations) and `NET_ADMIN` (veth, nftables and ipset inside the test namespaces). It retains Docker's default seccomp policy, enables no-new-privileges and never receives privileged mode, host networking/PIDs, host mounts or a Docker socket. On AppArmor-enabled daemons only this helper uses `apparmor=unconfined`, because Docker's default AppArmor policy denies the required mounts. See Docker's [capability guidance](https://docs.docker.com/engine/containers/run/) and [AppArmor policy guidance](https://docs.docker.com/engine/security/apparmor/).
+
+The original harness still creates and verifies separate network/mount/PID namespaces before firewall mutations. A preflight namespace probe fails clearly when the daemon/kernel does not support the required isolation; there is no skip, privileged retry or host-firewall fallback. The daemon must support namespaces, IPv6, veth, nftables, iptables and ipset; the helper cannot load missing host kernel modules. Its immutable image ID is used for execution and its container/image are cleaned up while preserving the original test exit code.
+
+Because the harness masks `/etc`, the helper resolves all six Debian iptables/ip6tables/save/restore alternatives to direct binary links at build time. Only public protocol/service name databases from the helper image are restored into the private `/etc`; no runner `/etc` files or credentials are copied. Local validation covers YAML and shell syntax, the fixture ACK unit test and a fake-Docker wrapper regression (isolation flags, build-context behavior, cleanup and nonzero exit propagation). Docker is unavailable locally, so the corrected native helper run remains pending CI.
+
+## Image build and publication
 
 2026-10-26 checkpoint: Docker CLI is still absent and `wsl --status` reports WSL is not installed. Local checks passed for the full-size fresh fixture/reuse refusal, selected-platform manifest validation and generated-schema drift check. These are not native container results. The load runner requires zero telemetry history/watermarks/totals, checks three unique raw reports and 200/400 deltas per agent plus 20000/40000 fleet totals, and reports report-ingestion and timeseries p95 independently. The first v2 counter establishes a baseline, so it contributes no fabricated traffic.