Merge outbound policy transport implementation

# Conflicts:
#	Cargo.lock
#	Cargo.toml
#	Dockerfile.test
#	Makefile

tests/kind/lib-test.sh

@@ -94,4 +94,14 @@ if [[ "${cleanup_calls[*]}" != "durable coordination oidc target secret" ]]; the
   exit 1
 fi
 
+FIXTURE_LOCK_DIR="$RUNTIME/lock-test"
+FIXTURE_LOCK_PATH="$FIXTURE_LOCK_DIR/remora-testbed-kind.lock"
+acquire_fixture_lock
+if XDG_RUNTIME_DIR="$FIXTURE_LOCK_DIR" bash -c \
+  'source "$1"; acquire_fixture_lock' _ "$ROOT/tests/kind/lib.sh" 9>&-; then
+  printf 'singleton fixture lock admitted a second worktree process\n' >&2
+  exit 1
+fi
+exec 9>&-
+
 printf 'fixture family matrix tests passed\n'

tests/kind/lib.sh

@@ -6,6 +6,8 @@ TESTBED="$ROOT/tests/kind"
 RUNTIME="$TESTBED/.runtime"
 BIN="$RUNTIME/bin"
 KUBECONFIG_PATH="$RUNTIME/kubeconfig"
+FIXTURE_LOCK_DIR="${XDG_RUNTIME_DIR:-/tmp/remora-$(id -u)}"
+FIXTURE_LOCK_PATH="$FIXTURE_LOCK_DIR/remora-testbed-kind.lock"
 CONTEXT=kind-remora-testbed
 CLUSTER=remora-testbed
 NERDCTL_NAMESPACE=remora-wp02
@@ -69,8 +71,8 @@ prepare_provider() {
 }
 
 acquire_fixture_lock() {
-  mkdir -p "$RUNTIME"
-  exec 9>"$RUNTIME/fixture.lock"
+  mkdir -p "$RUNTIME" "$FIXTURE_LOCK_DIR"
+  exec 9>"$FIXTURE_LOCK_PATH"
   if ! flock --nonblock 9; then
     printf 'kind test fixture is already in use\n' >&2
     return 1
@@ -248,7 +250,7 @@ select_fixture_families() {
       all)
         use_all=true
         ;;
-      durable | coordination | oidc | target | secret) ;;
+      base | durable | coordination | oidc | target | secret) ;;
       *)
         printf 'unknown fixture family: %s\n' "$family" >&2
         return 1

tests/kind/outbound-job.yaml.in

@@ -0,0 +1,24 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: @@JOB_NAME@@
+  namespace: remora-testbed
+spec:
+  activeDeadlineSeconds: 300
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      containers:
+        - name: tests
+          image: @@TEST_IMAGE@@
+          imagePullPolicy: Never
+          env:
+            - name: REMORA_OUTBOUND_REQUIRE_IPV6
+              value: "1"
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+            limits: {cpu: "1", memory: 512Mi}

tests/kind/run-outbound-job.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+source "$ROOT/tests/kind/lib.sh"
+
+USER_KUBECONFIG_BEFORE="$(user_kubeconfig_digest)"
+SUCCEEDED=false
+OWNS_FIXTURE=false
+
+cleanup() {
+  local status=$?
+  trap - EXIT INT TERM
+  if [[ "${REMORA_TESTBED_RETAIN:-0}" = 1 ]] && [[ "$SUCCEEDED" != true ]]; then
+    printf 'retained kubeconfig: %s\n' "$KUBECONFIG_PATH"
+    printf 'retained context: %s\n' "$CONTEXT"
+    exit "$status"
+  fi
+  if [[ "$OWNS_FIXTURE" = true ]]; then
+    destroy_fixture || status=1
+  fi
+  if [[ "$(user_kubeconfig_digest)" != "$USER_KUBECONFIG_BEFORE" ]]; then
+    printf 'user kubeconfig changed unexpectedly\n' >&2
+    status=1
+  fi
+  exit "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+acquire_fixture_lock
+REMORA_REAL_NERDCTL="$(command -v nerdctl)"
+export REMORA_REAL_NERDCTL
+"$REMORA_REAL_NERDCTL" --namespace default build \
+  --file "$ROOT/Dockerfile.test" \
+  --target kind-outbound-runner \
+  --tag remora-kind-outbound:local \
+  "$ROOT"
+OWNS_FIXTURE=true
+setup_fixture base
+load_local_image remora-kind-outbound:local
+run_job_matrix \
+  outbound-policy \
+  "$TESTBED/outbound-job.yaml.in" \
+  remora-kind-outbound:local \
+  base
+SUCCEEDED=true
+printf 'outbound policy transport package test Job passed\n'