test(podman): probe lifted e2e exclusions in the tmachine guest (do not merge)

tests/ansible/playbooks/drivers/podman/e2e.yaml

@@ -58,6 +58,14 @@
       ansible.builtin.command:
         argv: [/usr/local/bin/openshell, gateway, add, http://127.0.0.1:17670, --local, --name, tmachine]
 
+    # DIAGNOSTIC PROBE, NOT FOR MERGE (#3712): `script` backs the PTY helper
+    # used by the sandbox_lifecycle tests.
+    - name: Install guest tools used by the E2E archive
+      become: true
+      ansible.builtin.dnf:
+        name: util-linux-script
+        state: present
+
     - name: Run Podman E2E archive tests
       ansible.builtin.command:
         argv:
@@ -109,6 +117,53 @@
         var: podman_e2e_gateway_journal.stdout_lines
       when: podman_e2e_test_result.rc != 0
 
+    # DIAGNOSTIC PROBE, NOT FOR MERGE (#3712): evidence for the IP-literal
+    # timeouts in proxy_egress_pipeline and the policy DNS failure in
+    # transparent_tcp.
+    - name: Capture Podman network diagnostics after Podman E2E test failure
+      ansible.builtin.shell: |
+        echo "== podman network inspect tmachine"
+        podman network inspect tmachine
+        echo "== podman ps -a"
+        podman ps -a
+      args:
+        executable: /bin/bash
+      environment:
+        HOME: /home/tmachine
+        XDG_RUNTIME_DIR: /run/user/1000
+      changed_when: false
+      failed_when: false
+      when: podman_e2e_test_result.rc != 0
+      register: podman_e2e_podman_diagnostics
+
+    - name: Capture guest network diagnostics after Podman E2E test failure
+      become: true
+      ansible.builtin.shell: |
+        echo "== ip -brief addr"
+        ip -brief addr
+        echo "== ip route"
+        ip route
+        echo "== getenforce"
+        getenforce
+        echo "== nft ruleset (first 80 lines)"
+        nft list ruleset 2>&1 | head -80
+      args:
+        executable: /bin/bash
+      changed_when: false
+      failed_when: false
+      when: podman_e2e_test_result.rc != 0
+      register: podman_e2e_guest_diagnostics
+
+    - name: Show Podman network diagnostics after Podman E2E test failure
+      ansible.builtin.debug:
+        var: podman_e2e_podman_diagnostics.stdout_lines
+      when: podman_e2e_test_result.rc != 0
+
+    - name: Show guest network diagnostics after Podman E2E test failure
+      ansible.builtin.debug:
+        var: podman_e2e_guest_diagnostics.stdout_lines
+      when: podman_e2e_test_result.rc != 0
+
     - name: Require Podman E2E archive success
       ansible.builtin.assert:
         that: [podman_e2e_test_result.rc == 0]

tests/artifacts.nix

@@ -96,41 +96,18 @@ let
     output = "artifacts/test-archives/${muslToolchain.target}/provider-refresh-keycloak-tests.tar";
   };
 
-  # Follow-up: migrate these wrapper-coupled tests once tmachine provides their
-  # managed-gateway controls, SPIFFE fixtures, caller driver-config setting,
-  # guest tools, and matching workload-image identity behavior. The corporate
-  # proxy and gateway-start binaries currently self-skip without wrapper-owned
-  # gateway metadata, so exclude them rather than report false passes.
+  # DIAGNOSTIC PROBE, NOT FOR MERGE (#3712): most exclusions are lifted so one
+  # tmachine run reports how each binary behaves in the rootless Fedora guest.
+  # Still excluded: the gateway-restart binaries (they self-skip without
+  # wrapper-owned gateway metadata, which tmachine does not set, so they would
+  # report false passes), provider_token_exchange (needs wrapper-set SPIFFE
+  # fixtures), and provider_auto_create / workspace_lifecycle (migrated in #4246).
   podmanE2eFollowUpBinaries = [
-    "credential_gating"
-    "driver_config_volume"
-    "forward_proxy_graphql_l7"
-    "forward_proxy_jsonrpc_l7"
-    "forward_proxy_l7_bypass"
-    "host_gateway_alias"
-    "landlock"
     "local_driver_token_restart"
-    # Standalone tmachine runs can time out while opening the localhost relay.
-    # Follow up on making the relay setup deterministic before restoring it.
-    "no_proxy"
     "podman_corporate_proxy"
     "podman_gateway_start"
-    "podman_oci_identity"
     "provider_auto_create"
-    # The provider-refresh feature suite covers revoked Keycloak grants. This
-    # binary instead covers stable workload handles across repeated rotations
-    # and explicit refresh reconfiguration in a long-running sandbox.
-    "provider_refresh_handles"
     "provider_token_exchange"
-    "proxy_egress_pipeline"
-    # Conformance covers stop/start workspace preservation and deletion while
-    # stopped. The remaining canonical-main, TTY, attachment replay, and
-    # no-keep cases still need migration. Nextest archive filters cannot select
-    # individual tests, so keep the complete binary in the follow-up bucket.
-    "sandbox_lifecycle"
-    # Needs a prebuilt musl DNS probe in guest artifact mode; tracked in #3009.
-    "transparent_tcp"
-    "websocket_conformance"
     "workspace_lifecycle"
   ];
   podmanE2eArchiveFilter =