[awf] Cloud Hypervisor guest network never comes up before connectivity probe — full egress blackout

[lpcox]

Problem
On the Cloud Hypervisor microVM backend, the guest connectivity probe fails with exit code 4 because the guest's loopback interface (lo) is still DOWN when the probe runs, producing a full egress blackout (zero requests to any allowed domain) before the agent process even starts.

Context
Original issue: github/gh-aw#53935 (repo: github/gh-aw), labeled P0. Reproduced across two workflows/engines (Claude, Copilot) 22 minutes apart; audit-diff confirms zero allowed/blocked requests vs. the prior successful run.

Root Cause
Likely a race in the Cloud Hypervisor guest VM boot sequence (see docs/cloud-hypervisor-foundation.md): the connectivity probe runs before the guest's network stack (including lo) is fully initialized, so the host-side proxy port is reachable but the guest itself has no usable networking, causing the probe to fail generically rather than with a clear, fast, labeled error.

Proposed Solution

1. Add an explicit, fast pre-flight check for guest lo state before running the full connectivity probe, and surface a distinct, clearly-labeled fatal error (e.g. guest-network-not-ready) instead of letting it cascade into misleading engine-specific errors.
2. Add a bounded retry/backoff on the boot-readiness check to absorb the race instead of failing after the first attempt.
3. Add regression coverage that boots a guest and asserts lo is up before returning from the launcher's readiness gate.

Generated by Firewall Issue Dispatcher · auto · 29.2 AIC · ⊞ 9.3K · ◷