fix: prove Linux Agent sandbox boundary

hub/deploy/install_service.sh

@@ -24,13 +24,14 @@ ENV_FILE="${ENV_FILE:-$BASE/.secrets/platform.env}"
 SYSTEMD_UNIT_DIR="${SYSTEMD_UNIT_DIR:-/etc/systemd/system}"
 NODE_BIN="${NODE_BIN:-$(command -v node || true)}"
 BWRAP_BIN="${BWRAP_BIN:-$(command -v bwrap || true)}"
+SOCAT_BIN="${SOCAT_BIN:-$(command -v socat || true)}"
 PG_ISREADY_BIN="${PG_ISREADY_BIN:-$(command -v pg_isready || true)}"
 RUNUSER_BIN="${RUNUSER_BIN:-$(command -v runuser || true)}"
 SETPRIV_BIN="${SETPRIV_BIN:-$(command -v setpriv || true)}"
 CPH_BIN_DEFAULT="${CPH_BIN_DEFAULT:-/usr/local/bin/cph}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PREFLIGHT_JS="$HUB_DIR/dist/deployment/preflight-cli.js"
-RUNTIME_PATH="$(dirname "$NODE_BIN"):$(dirname "$BWRAP_BIN"):$(dirname "$SETPRIV_BIN"):/usr/local/bin:/usr/bin:/bin"
+RUNTIME_PATH="$(dirname "$NODE_BIN"):$(dirname "$BWRAP_BIN"):$(dirname "$SOCAT_BIN"):$(dirname "$SETPRIV_BIN"):/usr/local/bin:/usr/bin:/bin"
 
 fail() {
   echo "[install] error: $*" >&2
@@ -68,6 +69,7 @@ done
 for pair in \
   "NODE_BIN:$NODE_BIN" \
   "BWRAP_BIN:$BWRAP_BIN" \
+  "SOCAT_BIN:$SOCAT_BIN" \
   "PG_ISREADY_BIN:$PG_ISREADY_BIN"; do
   label="${pair%%:*}"
   value="${pair#*:}"
@@ -98,6 +100,7 @@ for pair in \
   "SYSTEMD_UNIT_DIR:$SYSTEMD_UNIT_DIR" \
   "NODE_BIN:$NODE_BIN" \
   "BWRAP_BIN:$BWRAP_BIN" \
+  "SOCAT_BIN:$SOCAT_BIN" \
   "RUNUSER_BIN:$RUNUSER_BIN" \
   "SETPRIV_BIN:$SETPRIV_BIN" \
   "RUNTIME_PATH:$RUNTIME_PATH"; do
@@ -152,6 +155,7 @@ PREFLIGHT_ARGS=(
   --cache-dir "$CACHE_DIR"
   --workspace-root "$WORKSPACE_ROOT"
   --bwrap-bin "$BWRAP_BIN"
+  --socat-bin "$SOCAT_BIN"
   --pg-isready-bin "$PG_ISREADY_BIN"
 )
 
@@ -247,6 +251,7 @@ sed \
   -e "s|__ENV_FILE__|$ENV_FILE|g" \
   -e "s|__NODE_BIN__|$NODE_BIN|g" \
   -e "s|__BWRAP_BIN__|$BWRAP_BIN|g" \
+  -e "s|__SOCAT_BIN__|$SOCAT_BIN|g" \
   -e "s|__RUNTIME_PATH__|$RUNTIME_PATH|g" \
   "$SCRIPT_DIR/cph-hub.service" >"$TMP_UNIT"
 install -o root -g root -m 0644 "$TMP_UNIT" "$UNIT"