feat(dind): gate docker run --privileged / --cap-add behind config

[luthermonson]

Summary

Adds [dind] allow_privileged to control whether sibling containers created through the fake docker daemon may opt into the full elevation stack (Privileged=true, all caps, all devices, seccomp+apparmor unconfined, writable sysfs/cgroupfs). Requests with HostConfig.Privileged=true or HostConfig.CapAdd are rejected with HTTP 403 before any image pull when the gate is closed.

Threat model

A privileged sibling container is effectively root on whatever host runs the containerd that backs dind:

• Windows / macOS — that backing containerd lives in a managed Linux VM (WSL2 / Hyper-V on Windows, Vz on macOS). A privileged escape stays inside the VM, not the bare metal.
• Linux host — ephemerd runs directly on the host with no VM fence. A privileged escape is bare-metal-host compromise.

The runner container itself (pkg/runtime/runtime.go) was already locked down to a minimum capability set + seccomp default. This PR closes the same hole for the dind-spawned siblings.

Default policy

The TOML key is a *bool so missing vs. explicit-false are distinguishable. ResolvedAllowPrivileged() picks the default:

Host GOOS	Default	Reasoning
windows	true	VM fence present (WSL2/Hyper-V)
darwin	true	VM fence present (Vz)
linux	false	No fence — opt-in only

Operators can override explicitly:

[dind]
allow_privileged = false  # deny on every host (e.g. shared CI)
# or
allow_privileged = true   # allow on Linux when workloads are trusted (KIND testing, etc.)

Implementation

• pkg/config/config.go — new DindConfig.AllowPrivileged *bool + platform-aware ResolvedAllowPrivileged().
• pkg/dind/dind.go — Server.allowPrivileged field + Config.AllowPrivileged plumbing; fixed misleading package doc that previously claimed dind never spawns privileged containers.
• pkg/dind/containers.go — early 403 short-circuit in handleContainerCreate for both Privileged=true and CapAdd != nil. Runs before image pull so we don't burn bandwidth on rejected requests.
• pkg/runtime/runtime.go — Config.DindAllowPrivileged forwarded into each per-job dind.Server.
• cmd/ephemerd/main.go — passes cfg.Dind.ResolvedAllowPrivileged() at both runtime.New sites.

Test plan

• go test ./pkg/config/... — 5 new tests: platform default, explicit-true/false override, omitted TOML key falls through to platform default, explicit-false on a non-Linux host overrides the default.
• go test ./pkg/dind/... (compile-checked under GOOS=linux) — 5 new tests: gate-closed rejects Privileged=true with 403 and useful body, gate-closed rejects CapAdd, non-privileged request not gated, nil HostConfig not gated, gate-open passes Privileged through.
• GOOS=linux ./bin/golangci-lint run ./... → 0 issues.
• mage build:windows produces a clean 700 MB binary.
• After merge: confirm the existing KIND-on-Windows-host e2e (which depends on the gate defaulting to true on Windows) still passes — should be a no-op behavior change on this host.

Local CI notes

mage test on Windows hosts trips the documented miekg/pkcs11 cgo failure for packages that transitively import it (pkg/dind is one). GOOS=linux go test -run xxx ./pkg/dind/... compiles clean — the GHA Linux runner will execute the new tests normally.