hisn 0.3.3

Fixed

• Session DNS on systemd-resolved hosts. The session's /etc/resolv.conf
  is now built from the host's non-loopback nameservers, else the
  systemd-resolved upstream file /run/systemd/resolve/resolv.conf, else the
  launch fails with no usable DNS resolver …. Loopback nameservers are never
  passed in, and an empty resolv.conf is never written. Evidence reported from a
  Fedora 45 host (hisn 0.3.2, wakil-dev rootfs): the session's resolv.conf was
  empty, getent hosts example.com returned rc=2, while curl -sI https://1.1.1.1
  returned HTTP/2 301. The host resolv.conf was the systemd stub (127.0.0.53)
  and the real upstreams were in /run/systemd/resolve/resolv.conf. The Fedora
  host itself was not re-run for this release. On the build host (non-loopback
  host resolv.conf) a network = "host" session showed the host nameserver
  with loopback dropped, and getent hosts example.com returned rc=0.
• Rootfs sessions on network = "host" no longer fail with no usable DNS resolver when the image's own etc/resolv.conf is empty (the wakil-dev
  image). The first version of this fix read only the image file for a rootfs
  session, so such a launch failed closed while the host had working
  resolvers. The precedence is now: [net] nameservers, then the host
  /etc/resolv.conf, then /run/systemd/resolve/resolv.conf, and the image's
  etc/resolv.conf only when neither host source has a usable nameserver. A
  populated image never shadows a working host resolver. The image file is read
  with openat2 (RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS), so a symlink in any
  component, including etc, is refused, and the upstream file is read
  from the real host, not from inside the image. Regression check: leak test
  L50 (runs when HISN_TEST_ROOTFS is set).

Added

• [net] nameservers = ["ip", ...] (profile): replaces the derived resolver
  list. Empty, non-IP and loopback entries are rejected at hisn profile validate.
• hisn exec --no-tty: non-interactive exec with no pty. Stdin is
  /dev/null; stdout and stderr are client-owned pipes that the client copies to
  its own stdout and stderr, so the sandbox never receives the caller's terminal.
  --tty --no-tty is a usage error. The refusal for a terminal without either
  flag still applies and now names both options.
• mounts.ro accepts src:dst (ADR 0012): the host path src is bound
  read-only (ro,nosuid,nodev) at the in-session path dst. Same-path entries
  are unchanged. dst under /run/hisn or a runtime root, dst containing
  .., and dst colliding with another session mount are rejected at validate,
  naming the path. A symlinked src directory is resolved on the host.
• policy validate and profile validate now run the mount plan, so mount
  conflicts are refused at validate, not only at session start.
• Leak tests L47–L49 (src:dst mount, validate refusals, symlinked source).

The leak suite (L1-L45) passed on Ubuntu 22.04 and 24.04 x86_64 CI runners for this exact commit before these binaries were built; the aarch64 binary is built and started (--version) but has not been leak-tested. The glibc binaries (hisn-x86_64-linux-gnu, hisn-aarch64-linux-gnu) are dynamically linked and built natively on Ubuntu 22.04 (glibc 2.35 or newer required). The musl binary (hisn-x86_64-linux-musl) is statically linked. Verify with sha256sum -c SHA256SUMS. See README, "Verifying a build".