chore: test reliability and speed skill

[sjmiller609]

Note

Medium Risk
Touches runtime paths for ingress binary extraction and default-network discovery, so any bugs could affect multi-process startups or instance networking on Linux. Changes are bounded (file-lock + atomic rename; short self-heal polling) and mainly aimed at reducing CI flakiness.

Overview
Improves Linux integration test reliability by hardening embedded Caddy extraction: ExtractCaddyBinary now uses a per-binary Flock and temp-file + atomic rename writes (including the .sha256) to avoid concurrent ETXTBUSY/partial-write races.

Makes default-network allocation more robust under concurrent tests by adding getDefaultNetworkWithSelfHeal, which re-runs initialization and briefly polls for bridge readiness before failing.

Reduces test flakiness/latency by removing an external S3 curl dependency in TestFirecrackerNetworkLifecycle (replaced with a local probe server), trimming redundant reachability assertions in running-fork tests, and lowering guest exec WaitForAgent timeout in execInInstance to speed up polling-based assertions.

Adds a new skills/test-agent skill with prompt and investigation notes documenting the flake root causes and validation runs.

^{Written by Cursor Bugbot for commit c94b92d. This will update automatically on new commits. Configure here.}

[cursor]

Automated risk assessment (based on code diff evidence only): Medium-High risk.

Why this is not low-risk:

• lib/network/allocate.go changes shared allocation behavior by introducing self-heal retry/polling logic in default network retrieval (CreateAllocation and RecreateAllocation paths).
• lib/ingress/binaries_linux.go changes concurrent binary extraction semantics (cross-process file lock + atomic write/rename path).
• New instruction files under skills/test-agent/agents/test-agent/PROMPT.md materially change prompt behavior for an automation agent.

Decision:

• Code review required.
• No self-approval for Medium-High risk.
• Reviewer assignment not changed because 2 reviewers are already assigned (rgarcia, hiroTamada) and max is 2.

Additional checks:

• No existing approvals were present, so no approval dismissal action was needed.
• No CODEOWNERS file was found in-repo, so codeowners-specific blocking could not be inferred from repository files.

---

  

[hiroTamada]

looks good -- solid flake fixes and test speed improvements. left one minor suggestion on the skill docs.

[hiroTamada]

consider adding a getting-started section covering environment setup (e.g. required OS, root access, firecracker/qemu binaries, bridge networking prereqs) and how to generate any tokens or credentials needed to run the test suite. right now someone picking up this skill for the first time would need to reverse-engineer the setup from the test code and CI config.