fix: prove Linux Agent sandbox boundary

hub/test/integration/deployment-preflight-cli.test.ts

@@ -128,6 +128,7 @@ describe("deployment preflight CLI", () => {
     expect(probeLog).toContain(workspaceRoot);
     expect(probeLog).toContain("service-setpriv\n");
     expect(probeLog).toContain("service-bwrap\n");
+    expect(probeLog).toContain("service-socat\n");
     expect(probeLog).toContain("service-prisma\n");
     expect(probeLog).toContain("service-database\n");
   });
@@ -141,6 +142,7 @@ describe("deployment preflight CLI", () => {
     const binDir = join(root, "bin");
     const cphBin = join(binDir, "cph");
     const bwrapBin = join(binDir, "bwrap");
+    const socatBin = join(binDir, "socat");
     const pgIsReadyBin = join(binDir, "pg_isready");
     const runuserBin = join(binDir, "runuser");
     const setprivBin = join(binDir, "setpriv");
@@ -155,6 +157,7 @@ describe("deployment preflight CLI", () => {
     await Promise.all([
       executable(cphBin, `#!/bin/sh\nprintf 'cph\\n' >> '${options.marker}'\nprintf 'cph 0.0.2\\n'\n`),
       executable(bwrapBin, `#!/bin/sh\nprintf 'service-bwrap\\n' >> '${options.marker}'\nexit 0\n`),
+      executable(socatBin, `#!/bin/sh\nprintf 'service-socat\\n' >> '${options.marker}'\nexit 0\n`),
       executable(
         runuserBin,
         `#!/bin/sh\nprintf '%s\\n' "$*" >> '${options.marker}'\n[ "$1" = "-u" ] || exit 91\nshift 2\n[ "$1" = "--" ] || exit 92\nshift\nexec "$@"\n`,
@@ -226,6 +229,8 @@ describe("deployment preflight CLI", () => {
         options.workspaceRoot,
         "--bwrap-bin",
         bwrapBin,
+        "--socat-bin",
+        socatBin,
         "--pg-isready-bin",
         pgIsReadyBin,
       ],