fix: prove Linux Agent sandbox boundary

hub/src/deployment/preflight-cli.ts

@@ -29,6 +29,7 @@ interface Options {
   readonly cacheDir: string;
   readonly workspaceRoot: string;
   readonly bwrapBin: string;
+  readonly socatBin: string;
   readonly pgIsReadyBin: string;
   readonly serviceUid?: number;
   readonly serviceGid?: number;
@@ -50,6 +51,7 @@ async function main(): Promise<void> {
   await validateExecutable(options.runuserBin, "runuser");
   await validateExecutable(options.setprivBin, "setpriv");
   await validateExecutable(options.bwrapBin, "bubblewrap");
+  await validateExecutable(options.socatBin, "socat");
   await validateExecutable(result.cphBin, "cph");
   await validateExecutable(options.pgIsReadyBin, "pg_isready");
   await validateCph(result.cphBin);
@@ -257,7 +259,7 @@ async function validateServiceRuntime(
     HOME: configuredInput.serviceHome,
     XDG_STATE_HOME: configuredInput.stateDir,
     XDG_CACHE_HOME: configuredInput.cacheDir,
-    PATH: [dirname(options.nodeBin), dirname(options.bwrapBin), dirname(result.cphBin), "/usr/bin", "/bin"].join(":"),
+    PATH: [dirname(options.nodeBin), dirname(options.bwrapBin), dirname(options.socatBin), dirname(result.cphBin), "/usr/bin", "/bin"].join(":"),
   };
   const pathAccessRequirements = (input: DeploymentPreflightInput) => [
     [input.hubDir, constants.R_OK | constants.X_OK],
@@ -278,6 +280,7 @@ async function validateServiceRuntime(
     ...pathAccessRequirements(canonicalInput),
     [options.nodeBin, constants.X_OK],
     [options.bwrapBin, constants.X_OK],
+    [options.socatBin, constants.X_OK],
     [options.setprivBin, constants.X_OK],
     [result.cphBin, constants.X_OK],
   ] as const;
@@ -315,6 +318,7 @@ async function validateServiceRuntime(
     "Hub dependency and authenticated database probe",
   );
   await runAsService(options, serviceEnv, result.cphBin, ["--version"], "cph runtime probe");
+  await runAsService(options, serviceEnv, options.socatBin, ["-V"], "socat runtime probe");
   await runAsService(
     options,
     serviceEnv,
@@ -390,6 +394,7 @@ function parseArgs(argv: readonly string[]): Options {
     "--cache-dir",
     "--workspace-root",
     "--bwrap-bin",
+    "--socat-bin",
     "--pg-isready-bin",
     "--service-uid",
     "--service-gid",
@@ -417,6 +422,7 @@ function parseArgs(argv: readonly string[]): Options {
     cacheDir: required(values, "--cache-dir"),
     workspaceRoot: required(values, "--workspace-root"),
     bwrapBin: required(values, "--bwrap-bin"),
+    socatBin: required(values, "--socat-bin"),
     pgIsReadyBin: required(values, "--pg-isready-bin"),
     ...(serviceUid === undefined ? {} : { serviceUid, serviceGid: serviceGid! }),
   };