Stabilize privileged networking and DNS tests

[kacy]

Summary

• stabilize privileged networking tests around service discovery timing and container readiness
• make the networking probe use the container's configured DNS server instead of assuming a fixed resolver address
• keep legacy service-name persistence in sync with endpoint registration and removal so discovery reflects backend lifecycle changes
• tolerate statically linked test binaries when building networking root filesystems

Why

The privileged networking coverage was flaky because some tests assumed service DNS was immediately ready, assumed a fixed bridge resolver IP inside the probe binary, and could leave service-name state out of sync after backend removal or replacement.

Impact

This makes the privileged networking and DNS coverage more reliable and keeps service discovery behavior aligned with container lifecycle changes.

Validation

• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='containers discover each other by name'
• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='service discovery stops resolving after backend removal'
• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='service discovery recovers after backend replacement'
• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='http service is reachable from host port and by service name'
• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='port mapping makes container reachable from host'
• YOQ_SKIP_SLOW_TESTS=1 zig build test-privileged -Doptimize=ReleaseSafe -Dtest-filter='container gets an IP address'