[CMGS]

Stacked on #170 (base feat/egress-rule-ports); merge order #169 → #170 → this → the review PR that follows. One commit of its own. Closes #167.

The desktop image's guest-proxy-setup decided from NIC presence, so on a guarded bridge lane the GNOME session and osworld-server got neither a route nor the relay; and the boolean marker #165 introduced only said "locked", which left a NIC-bearing guest no way to tell "the host has not decided yet" from "the host says direct".

Change

• sandboxd/engine/lane.go replaces nicmark.go: Lane (relay | direct) and Engine.MarkLane write /etc/silkd-lane through the existing fs_write path.
• sandboxd/pool: laneOf(key) is empty on the none lane (no NIC to route through), relay when the lane is locked (bridge), else direct (CNI); markLane writes it at the same three sites the marker used (golden build after the readiness probe, cold provision, the late reconcile lock). The .nic golden sidecar stores the word, so a golden built under another verdict — including one built by the marker version — is rebuilt, not adopted; none-lane goldens keep matching. Engine.MarkLane replaces MarkNICLocked; fake engines follow.
• silkd/src/net.rs: routes_directly() is true only for a NIC whose lane file does not read relay; an absent or unreadable file routes directly, so an old sandboxd that writes nothing leaves the guest as it was. Unit test covers absent / direct / relay.
• os-image/desktop/24.04/Dockerfile: guest-proxy-setup still configures the relay at once when there is no NIC; with a NIC it waits for /etc/silkd-lane, follows relay, and exits on direct. The unit already ran After=silkd.service and Before=desktop-session.service osworld-server.service, so the session and osworld-server start after the verdict.
• e2e/cmd/desktopsmoke gains -net none|egress and -probe: on the egress lane the checkpoint/branch leg (refused on the lane) gives way to a /execute leg that requires http_proxy in the session's environment and a 200 from the allowed origin through the relay; the /execute parsing moved into one execute helper used by both legs.
• Docs: docs/silkd.md, docs/egress.md (lane paragraph), docs/desktop.md (lane bullet, unit bullet); desktop pools may use the egress lane again.

Decisions

• A two-word file instead of the boolean marker plus a timeout: "no file after N s" as the direct signal would freeze a wrong verdict into a golden and every clone of it when the host probe is slow; with direct written explicitly, a timeout fires only for an old sandboxd.
• The none lane gets no file: both consumers already treat no NIC as relay, and a file there would be a third source of the same fact.
• The reconcile late-lock case (a live claim whose node flipped CNI → bridge) is written but the running desktop session is not re-configured: a re-claim heals it, deploy.md makes draining claims part of upgrading, and silkd's execs follow the file at once.
• The marker is renamed, not kept alongside: egress: tell the guest when its NIC is locked so the bridge lane gets the proxy variables #165 shipped in no release tag.

Codex's review of this branch raised one MAJOR: a 30 s guest wait is shorter than the host's own worst case (90 s probe plus a 2-minute write timeout), so a late relay could land after the desktop had configured itself and been snapshotted. That is resolved in the review PR stacked on this one, the way the previous batch's round fixes rode #168 on #165: the wait is 300 s (longer than the host's success window, so a guest still waiting belongs to a boot the host already failed), the timeout exits non-zero so a mis-timed build is visible, the NIC test matches silkd's device-backed probe, and desktopsmoke asserts the unit is active. Merge this PR together with the review PR.

Hot path

None on the claim path: the write happens at golden build, cold provision and the late reconcile lock. silkd's per-exec cost on a NIC-bearing guest is one small read (the marker was one stat; measured below noise: 750 vs 745 µs exec RTT); the review PR latches a relay verdict so the bridge lane pays it once. Nothing on the none lane.

Tests and evidence

• TestLaneVerdictReachesGuestOnColdBoots (locked / unlocked egress lane and none lane, golden and cold), TestGoldenNICSidecarGatesAdoption; silkd lane_file_decides_relay.
• Gates: make go-lint 10 × 0 issues.; asl -forwarder=false clean on both GOOS; go test engine/pool; go vet ./... e2e; silkd cargo fmt --check, clippy -D warnings, 111 tests on macOS and 111 in a rust:1.98.0 linux/arm64 container.
• Hardware, cocoon-test1, guest images carrying this silkd (rt-lane4, desktop-lane4 = desktop:24.04 + this silkd + this guest-proxy-setup): scripts/egress-e2e.sh NET=none PASS and NET=egress BRIDGE=sbxbr0 PASS (direct egress blocked by the lock, allowed origin reached with and without -x with the injected credential, denied host 403); scripts/sandboxd-e2e.sh BRIDGE=sbxbr0 PASS including restart re-adoption; desktopsmoke -net egress PASS on a 2xlarge egress-lane desktop pool with a policy (screenshot, AT-SPI tree, PyAutoGUI click, then: the session's environment carries the relay and the allowed origin answers 200 through it, audited as a GET on port 80); desktopsmoke -net none PASS with the checkpoint/branch leg.