codex/fix podman proxy e2e config table

[drew]

Summary

Restore Podman corporate proxy E2E coverage under the split-container, host-networked supervisor design.

Related Issue

Stability investigation stacked on #3612 and ultimately #3583. The full local Podman suite found that the proxy test inserted settings into a nested TOML table and used fixture aliases unavailable to the host-networked supervisor.

Changes

• Insert proxy settings directly under the Podman driver table in generated gateway TOML.
• Publish proxy and upstream fixtures on distinct host ports and address them through the pinned host alias.
• Preserve validated-IP CONNECT assertions, route loopback CONNECT targets from the fixture container to the host, and verify that the denied port never reaches the proxy.
• Make the test's public CA bundle readable by the non-root supervisor.

Testing

• mise run pre-commit: passed.
• mise run ci: passed.
• Focused local Podman proxy E2E: passed (2 tests, 81.66s); CLI conformance passed.
• Complete local Podman E2E: passed through both proxy tests; the next binary, podman_oci_identity, failed on an outdated container startup-user assertion. That separate test fix is next in the stack.

Checklist

• Signed-off conventional commit
• Full local CI passed
• Focused Podman E2E passed

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[drew]

Closing to narrow the automated flake investigation to the four selected fixes (#3583/#3588, #3598, #3604, #3608). The findings remain available here for later follow-up.